topic How to change or add meta data for syslog facility/priority fields in Getting Data In

How to change or add meta data for syslog facility/priority fields

infrauser — Tue, 21 Dec 2010 07:31:59 GMT

I have a syslog box forwarding to splunk for indexing. I have the input type setup as syslog. Unfortunately, it doesn't appear that splunk automatically decodes the syslog facility/priority integer. I would like to either add this meta data to each message (preferred) or change the incoming message (less preferred) before splunk indexes it.

I found a script over at splunkbase which appears to have the logic for the decoding portion, however it looks like this script can only be used during searches.

I would prefer not to go the route of performing the decoding during searching as it seems like it would add quite a bit of overhead compared to having it already indexed with the facility/priority.

Thanks in advance for any advice.

Re: How to change or add meta data for syslog facility/priority fields

infrauser — Wed, 22 Dec 2010 10:07:30 GMT

Following up, I've read a number of items which discourage the practice of adding fields to the index and instead using search time fields.

I ended up creating a lookup file with the priorities, facilities, severity. I then created a field extraction for the syslog priority and then a transform to output the associated facility/severity.

Re: How to change or add meta data for syslog facility/priority fields

infrauser — Tue, 04 Jan 2011 04:05:46 GMT

Following up, I've read a number of items which discourage the practice of adding fields to the index and instead using search time fields. I ended up creating a lookup file with the priorities, facilities, severity. I then created a field extraction for the syslog priority and then a transform to output the associated facility/severity. – infrauser Dec 22 at 2:07

Re: How to change or add meta data for syslog facility/priority fields

Jason — Tue, 25 Sep 2012 12:50:46 GMT

Splunk can automatically decode it with the Syslog Priority Field Decoder Lookup app.

</plug>