Support API Gateway for Broadcom

[SurveillanceSI]

Note: If your issue is not a bug or a feature request, please raise a support ticket through our support portal (Splunk.com > Support > Support Portal). This will help us resolve your issue more efficiently and provide you with better assistance. For more information on how to work with the Splunk Support, please refer to this guide.

What is the sc4s version?

4.8.1

Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?

NO

What the vendor name?

Broadcom

What's the product name?

API Gateway (Layer 7)

If you're requesting support for a new vendor, do you have any preferences regarding the default index and sourcetype for their events?

NA

Do you have syslog documentation or a manual for that device??

NA

Feature Request description:

Do you want to have it for local usage or prepare a github PR?

LOCAL

[SurveillanceSI]

Here is a PCAP of the data being sent to syslog.

[sbylica-splunk]

Hi @SurveillanceSI I can take a look at this, do you have some other examples of logs, preferably in text form or a .pcap file?

[sbylica-splunk]

Ok I created a parser based on this one event and some other info found in the broadcom docs, should be a part of next release. If we get some more real-life logs we can also revisit this in the future