Juniper Switches Syslog Parser

[marakji-splunk]

What is the sc4s version?
3.27.0
Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?
I can provide this through a support case.
What the vendor name?
Juniper
What's the product name?
Switch
If you're requesting support for a new vendor, do you have any preferences regarding the default index and sourcetype for their events?
Existing vendor
Do you have syslog documentation or a manual for that device??

Feature Request description:
our customer have a large fleet of Juniper Switches, we've got SC4S configured and we're getting the logs into Splunk, but 90% of the logs are coming as nix:syslog. Digging into the "Splunk Add-on for Juniper", it doesn't really do much for switches, it focuses more on firewalls. Please assist.
Do you want to have it for local usage or prepare a github PR?
github PR

[cwadhwani-splunk]

Hi @marakji-splunk
Could you please create a support case and provide the pcap file?
Thanks.

[marakji-splunk]

Apologies for the delay, please give me some time as I'm still figuring out a way to do the PCAP, i'm running my SC4S on microk8s. Thanks,

…

On Mon, Jul 29, 2024 at 7:37 PM cwadhwani-splunk ***@***.***> wrote: Hi @marakji-splunk <https://github.com/marakji-splunk> Could you please create a support case and provide the pcap file? Thanks. — Reply to this email directly, view it on GitHub <#2535 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A4HS7RC3OCBCLZ7HWAKEHLDZOYEN7AVCNFSM6AAAAABLJMZOOGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENJVGQ3DANRYGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Mustapha Arakji Senior Professional Services Consultant Splunk Inc. +61 421 821 634 | ***@***.*** SYDNEY | AMER | *APAC* | EMEA [image: Splunk: Resilience. Let's build it together.] <https://www.splunk.com/> This message is intended only for the personal, confidential, and authorized use of the recipient(s) named above. If you are not that person, you are not authorized to review, use, copy, forward, distribute or otherwise disclose the information contained in the message.