Need to create a parser to parse vmware aria automation logs

[rbollghub]

Note: If your issue is not a bug or a feature request, please raise a support ticket through our support portal (Splunk.com > Support > Support Portal). This will help us resolve your issue more efficiently and provide you with better assistance. For more information on how to work with the Splunk Support, please refer to this guide.

Was the issue replicated by support?

What is the sc4s version ?

Which operating system (including its version) are you using for hosting SC4S?

Which runtime (Docker, Podman, Docker Swarm, BYOE, MicroK8s) are you using for SC4S?

Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?

Is the issue related to the environment of the customer or Software related issue?

Is it related to Data loss, please explain ?
Protocol? Hardware specs?

Last chance index/Fallback index?

Is the issue related to local customization?

Do we have all the default indexes created?

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

[cwadhwani-splunk]

Hi @rbollghub
We will need pcap file to get the raws logs to work on this request. Could you please create a support ticket and attach the PCAP file there?

[cwadhwani-splunk]

Closing this GitHub issue due to unavailability of the PCAP file. Please feel free to reopen this case once a support ticket is created with the PCAP file attached. Thanks!

[rbollghub]

Hello, Please I was in-disposed. Your request will be honored this week. v/r Seli Classification: Confidential From: cwadhwani-splunk ***@***.***> Sent: Wednesday, January 8, 2025 5:01 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2626) You don't often get email from ***@***.******@***.***>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Closing this GitHub issue due to unavailability of the PCAP file. Please feel free to reopen this case once a support ticket is created with the PCAP file attached. Thanks! - Reply to this email directly, view it on GitHub<#2626 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLBDR3AVPPUXUCLBO232JTZL7AVCNFSM6AAAAABQP4OYESVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNZXGI3DKMRSHE>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[cwadhwani-splunk]

Hi @rbollghub
I hope you are doing good.
Please create a support ticket and attach the PCAP in the same. This is a secure way of sending us the PCAP. Once we have it we will prioritise it.
Thanks!

[rbollghub]

Should this be a Splunk support ticket on Splunk or in github?

[cwadhwani-splunk]

You can raise a a Splunk support ticket to attach pcap.

[rbollghub]

Thank you