https://community.splunk.com/t5/Getting-Data-In/Splunk-and-syslog-help-needed/m-p/70738#M14392 <P>It needs to be set to true.</P> <PRE><CODE>[udp://514] no_priority_stripping = true </CODE></PRE> <P>This will keep your priority field on any syslog events indexed into splunk via udp port 514. This won't work for TCP syslog though.</P> Fri, 08 Jun 2012 11:06:02 GMT sdaniels 2012-06-08T11:06:02Z https://community.splunk.com/t5/Getting-Data-In/Splunk-and-syslog-help-needed/m-p/70737#M14391 <P>"no-priority-stripping" is set to False by default.&nbsp;&nbsp;&nbsp;&nbsp;I'm sure there's a good reason for that, but Splunk doesn't seem to index the priorities before stripping them, which makes it difficult for me to narrow down events.&nbsp;&nbsp;I've tried "anomalies" and a couple of other search modifiers, but I still get results I don't need (e.g. non-important maillog entries).</P> <P>Any ideas, how do others do it ?</P> Fri, 08 Jun 2012 11:01:57 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-and-syslog-help-needed/m-p/70737#M14391 itsy101 2012-06-08T11:01:57Z https://community.splunk.com/t5/Getting-Data-In/Splunk-and-syslog-help-needed/m-p/70738#M14392 <P>It needs to be set to true.</P> <PRE><CODE>[udp://514] no_priority_stripping = true </CODE></PRE> <P>This will keep your priority field on any syslog events indexed into splunk via udp port 514. This won't work for TCP syslog though.</P> Fri, 08 Jun 2012 11:06:02 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-and-syslog-help-needed/m-p/70738#M14392 sdaniels 2012-06-08T11:06:02Z