https://community.splunk.com/t5/Getting-Data-In/Syslog-Priority-Levels-Stripped-for-UDP-and-TCP-Syslog-Messages/m-p/14395#M1470 <P>All, I noticed discussions on how to prevent Splunk from stripping priority levels from UDP Syslog messages.</P> <P>Will priority stripping occur if Splunk receives messages via TCP port 514?</P> <P>If so, how would you configure Splunk to not strip the priority?</P> <P>Stephanie</P> Thu, 27 May 2010 23:48:12 GMT scornish 2010-05-27T23:48:12Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Priority-Levels-Stripped-for-UDP-and-TCP-Syslog-Messages/m-p/14395#M1470 <P>All, I noticed discussions on how to prevent Splunk from stripping priority levels from UDP Syslog messages.</P> <P>Will priority stripping occur if Splunk receives messages via TCP port 514?</P> <P>If so, how would you configure Splunk to not strip the priority?</P> <P>Stephanie</P> Thu, 27 May 2010 23:48:12 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Priority-Levels-Stripped-for-UDP-and-TCP-Syslog-Messages/m-p/14395#M1470 scornish 2010-05-27T23:48:12Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Priority-Levels-Stripped-for-UDP-and-TCP-Syslog-Messages/m-p/14396#M1471 <P>Priority stripping is optionally set for UDP inputs. It should not occur if you have configured a TCP input over port 514. For more information regarding the configuration, review the UDP settings for inputs.conf at following link:</P> <P><A href="http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf</A></P> <PRE><CODE>no_priority_stripping = true * If this attribute is set to true, then Splunk does NOT strip the &lt;priority&gt; syslog field from received events. * NOTE: Do NOT include this key if you want to strip &lt;priority&gt;. </CODE></PRE> Fri, 28 May 2010 01:38:00 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Priority-Levels-Stripped-for-UDP-and-TCP-Syslog-Messages/m-p/14396#M1471 Simeon 2010-05-28T01:38:00Z