NOTE: This filter will simply parse the syslog message itself, and will not perform the (required) re-assembly of related
messages to create meaningful final output. This will require follow-on processing in Splunk.
This sourcetype will conflict with sendmail itself, so will require that the PPS send syslog on a dedicated port or be uniquely identifiable with a hostname glob or CIDR block if this sourcetype is desired for PPS.
#/opt/sc4s/local/config/app-parsers/app-vps-proofpoint_pps.conf#File name provided is a suggestion it must be globally uniqueapplicationapp-vps-test-proofpoint_pps[sc4s-vps]{filter{host("pps-*"type(glob))};parser{p_set_netsource_fields(vendor('proofpoint')product('pps'));};};