topic OpenText NetIQ Logs onboarding via syslog in Getting Data In

OpenText NetIQ Logs onboarding via syslog

tech_g706 — Wed, 14 May 2025 11:52:11 GMT

Hi All,

Anyone who has worked with OpenText NetIQ Logs before?

We are receiving the NetIQ logs via syslog, but the sourcetype is set as default 'syslog', and field extractions are not performed properly.

Since I do not find any Splunk TA for NetIQ logs, I would need some suggestions for the source type assignment for NetIQ logs. Thank you

Re: OpenText NetIQ Logs onboarding via syslog

kiran_panchavat — Wed, 14 May 2025 12:09:53 GMT

@tech_g706

The default syslog sourcetype is too generic and often leads to improper parsing, as it’s not tailored to specific log formats like NetIQ. Instead, create a custom sourcetype to handle the unique structure of NetIQ logs.

1. Review the Answers post

Solved: What are the best practices for defining source ty... - Splunk Community

Reference:

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Listofpretrainedsourcetypes

https://kinneygroup.com/blog/splunk-magic-8-props-conf/

Re: OpenText NetIQ Logs onboarding via syslog

livehybrid — Wed, 14 May 2025 12:17:57 GMT

Hi @tech_g706

The issue here is that syslog arrives with the default syslog sourcetype and you shouldnt start applying field extractions to a default sourcetype.

Do you use the syslog input for any other feeds? If you dont use it for other feeds then one thing you could do is change/specify the sourcetype in the syslog input stanza to something specific to something like "netiq:log" and then you can apply your relevant props/transforms based on this sourcetype.

However, if you are you using the syslog input for other feeds too then you would need to use some other props/transforms to determine IF it is netIQ and then apply props accordingly, such as changing the sourcetype for that data.

The other thing which you might want to look at is using Splunk for Syslog (SC4S) which supports the CEF format that NetIQ is sending, check out the relevant SC4S docs here

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: OpenText NetIQ Logs onboarding via syslog

tech_g706 — Wed, 14 May 2025 13:45:50 GMT

@livehybrid @kiran_panchavat thank you very much.

| set the props like this, and field extractions are fine now.

[netiq]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)<\d+>
TIME_PREFIX = rt=
TIME_FORMAT = %s%3N
MAX_TIMESTAMP_LOOKAHEAD = 20
KV_MODE = auto
TRUNCATE = 99999

Re: OpenText NetIQ Logs onboarding via syslog

kiran_panchavat — Wed, 14 May 2025 16:53:03 GMT

@tech_g706

You’re welcome! I’m glad to hear the props configuration worked as expected