ACN_CD_InfobloxParserUpdate

[ghost]

Fixes #

Proposed Changes

• SyslogMessage was not including the Header (RFC3164) part of the message, only the MSG part, which is the proper way. This update modifies the parser (Kusto Function) to remove the parsing of the Header

[ashwin-patil]

Tested first part only.

Update: I tested further by changing ProcessName== logic in each subparser to Syslogmessage contains "" . looks like Test Data has incorrect ProcessName assigned.

Both Type, Response time are not parsed correctly or coming empty in each sub-parser section.

[ashwin-patil]

Update: I tested further by changing ProcessName== logic in each subparser to Syslogmessage contains "" .

Added comments in some sections where parsing was incorrect

[ghost]

@ashwin-patil my apologies, the old sample data was not updated. I have uploaded the updated sample data is reflective of live data stream.

[ashwin-patil]

Few things I noticed per new Sample data:

• Facility is set as daemon, if its right in SampleData then we have to change in the query from local6 to daemon.
• Not required, but per new data, we can change Computer to computer1.domain.org from datasource
• just wanted to check , new data only has DHCPDISCOVER events, if we don’t have other event types samples to test then I`ll approve for now as DHCPDISCOVER parsing looks good.

[ashwin-patil]

@ashwin-patil my apologies, the old sample data was not updated. I have uploaded the updated sample data is reflective of live data stream.

No problem, added couple of things based on new sample data.

[ashwin-patil]

Approved based on the testing on available sample data .

I think user instructions on Facility looks good to me, i`ll let @preetikr review it for any changes if required before merging.

[preetikr]

I'll merge this after the respective workbook and analytics changes make it to production.

[ghost]

@preetikr Following up on this, is there anything outstanding?

[preetikr]

The analytic rule template and workbook changes are now in production so merging the parser change as well.