fix: fix Dell EMC Powerswitch n parser

solves https://github.com/splunk/splunk-connect-for-syslog/issues/2180

This Pull Request introduces a breaking change to the codebase that addresses an issue related to parsing logs from Dell EMC PowerSwitch N devices. Previously, the logs were parsed based on message content using the syslog parser located at package/etc/conf.d/conflib/syslog/app-syslog-dell_switch_n.conf.

Background

In issue #2180, it was reported that the existing parser had a bug and incorrectly classified events from various devices such as VMware vSphere, ISC BIND, Cisco IOS, and Aruba ClearPass. The root cause of the issue was identified as a flawed design of the parser, which did not rely on unique message characteristics of Dell PowerSwitch N devices. Instead, it improperly classified events based on the hyphen in the hostname, whenever the program name started with an uppercase letter.

Breaking Change Details

To rectify this issue and improve the accuracy of log parsing, a breaking change was introduced. The syslog parser package/etc/conf.d/conflib/syslog/app-syslog-dell_switch_n.conf has been replaced with a new netsource parser located at package/etc/conf.d/conflib/netsource/app-netsource-dell_switch_n.conf.

Impact

This breaking change will affect any existing functionality or configurations that relied on the previous syslog parser for Dell PowerSwitch N logs.

splunk / splunk-connect-for-syslog