topic Re: Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible? in Getting Data In

Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

OlegB — Fri, 01 Feb 2013 20:25:41 GMT

I wonder if there is a way of parsing/searching syslog messages, simpler than editing config files, and writing applications? RFC 5424 is a well known standard, after all? Why isn't it possible to search (or even see) the most important fields, priority and facility?
Is there something I'm missing?

Re: Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

OlegB — Mon, 28 Sep 2020 13:13:30 GMT

So I downloaded RFC5424 Syslog app. To get severity and facility decoded, I need to set no_priority_stripping=yes in the config files, but this setting effectively kills the value of the syslog timestamp, by not translating it to local.
Is there any way to show the messages the way they're supposed to be seen?

Re: Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

Ayn — Fri, 01 Feb 2013 21:11:43 GMT

What do you mean by not translating the timestamp to local?

EDIT: ...and what do you mean by showing the messages "the way they're supposed to be seen"? What way is that?

Re: Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

OlegB — Mon, 04 Feb 2013 22:59:52 GMT

Timestamp gets taken from syslog message, which may be specified in different time zone, say, UTC. So I can't see the messages if search, say, for the last hour.
RFC defines format quite well. Priority, facility, and a set of standard fields. Currently, to see those I need to install an app, and search with a three line query. Doesn't seem right for an RFC specified format.

Re: Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

Ayn — Mon, 04 Feb 2013 23:39:17 GMT

Regarding timestamp extraction, see this section of the docs: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

If you don't want Splunk to use the time when the events were actually generated, you could tell it to use the index time instead (an option which itself has its dangers). A better approach imho would be to specify which timezones your sources have, which makes Splunk adjust its timestamp accordingly automatically.

As you discovered, by default Splunk will strip syslog headers. You can easily change this behaviour by specifying no_priority_stripping = true in the relevant section of your inputs.conf. Other than that Splunk indexes the raw events, which is why I was confused by what you said about messages being shown the way they're supposed to be seen - because if the original raw data is not how it's supposed to be seen, what IS the "correct" way to show it?

Re: Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

OlegB — Tue, 05 Feb 2013 14:13:05 GMT

Thanks, Ayn
The source of confusion may be the syslog format itself, mixing of encoded (priority/facility) and text fields.