https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17231#M2164 <P>Greetings experts,</P> <P>I am using syslog-ng and Splunk on the same box. I have configure syslog-ng to pipe the incoming syslogs to a FIFO and get Splunk to read the FIFO.</P> <P>Splunk can read and index the FIFO fine but the sourceType is unkown and I am trying to get Splunk to recognize the data as sourceType syslog.</P> <P>Can this be done? What needs to be modified?</P> <P>I have tried to configure the /$SPLUNK_HOME/etc/modules/input/FIFO/config.xml file but this did not seem to get the sourceType changed.</P> <P>Any help would be greatly appreciated.</P> <P>Bear</P> Mon, 12 Jul 2010 23:46:13 GMT bbear 2010-07-12T23:46:13Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17231#M2164 <P>Greetings experts,</P> <P>I am using syslog-ng and Splunk on the same box. I have configure syslog-ng to pipe the incoming syslogs to a FIFO and get Splunk to read the FIFO.</P> <P>Splunk can read and index the FIFO fine but the sourceType is unkown and I am trying to get Splunk to recognize the data as sourceType syslog.</P> <P>Can this be done? What needs to be modified?</P> <P>I have tried to configure the /$SPLUNK_HOME/etc/modules/input/FIFO/config.xml file but this did not seem to get the sourceType changed.</P> <P>Any help would be greatly appreciated.</P> <P>Bear</P> Mon, 12 Jul 2010 23:46:13 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17231#M2164 bbear 2010-07-12T23:46:13Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17232#M2165 <P>OK, I figured it out.</P> <P>I needed to add the sourcetype = syslog to my inputs.conf file under the fifo config.</P> Tue, 13 Jul 2010 00:16:46 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17232#M2165 bbear 2010-07-13T00:16:46Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17233#M2166 <P>A couple of things to point out. (This may vary slightly based on splunk version)</P> <P>I don't think you should ever have to mess with the <CODE>etc/modules/...</CODE> folder so I would recommend undoing any changes you made there.</P> <P>To set the sourcetype, you should be able to simply set the "sourcetype" parameter in your input stanza. So your <CODE>inputs.conf</CODE> entry should look something like this:</P> <PRE><CODE>[fifo:///var/path/to/fifo] sourcetype = syslog </CODE></PRE> <P>I should point out that splunk does not recommend the usage of fifo anymore. So I would suggest either (1) use syslog-ng to write to files and have splunk pick up those files, this has the advantage of protecting you against losing events whenever <CODE>splunkd</CODE> is restarted, or (2) if short outages (due to restarts) are not a problem for you then you can configure splunk to listen on a TCP (or UDP) port and have syslog-ng forward your events to that port. (You would use the same <CODE>sourcetype=syslog</CODE> option for that input as well.)</P> Tue, 13 Jul 2010 00:18:07 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17233#M2166 Lowell 2010-07-13T00:18:07Z https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17234#M2167 <P>Thanks for the help and advice.<BR /> I am experimenting with what is easiest and best so I removed the FIFO and went back to reading the udp port.</P> Thu, 15 Jul 2010 01:21:34 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-get-fifo-to-be-sourceType-syslog/m-p/17234#M2167 bbear 2010-07-15T01:21:34Z