topic How do keep splunk from removing syslog priority fields? in Getting Data In

How do keep splunk from removing syslog priority fields?

Chris_R_ — Tue, 09 Feb 2010 02:33:49 GMT

How do keep splunk from removing syslog priority fields? They are removed once indexed into splunk.

Re: How do keep splunk from removing syslog priority fields?

Chris_R_ — Tue, 09 Feb 2010 02:36:00 GMT

There is a optional flag within inputs.conf you can place in any UDP input stanza, such as

[udp://514]

no_priority_stripping = true

This will keep your priority field on any syslog events indexed into splunk via udp port 514

Re: How do keep splunk from removing syslog priority fields?

balbano — Mon, 28 Sep 2020 09:12:39 GMT

will this also work for SSL? for example:

[splunktcp-ssl:9996]
compressed = true
no_priority_stripping = true

Kindly confirm.

Thanks!

Brian

Re: How do keep splunk from removing syslog priority fields?

Chris_R_ — Thu, 20 May 2010 06:25:07 GMT

Unfortunately this only works with syslog via UDP inputs.
If using a tcp input, you would have to set up a props/transforms entry to store these fields.