topic For UDP inputs, does the raw log priority factor into LINE_BREAKER? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/For-UDP-inputs-does-the-raw-log-priority-factor-into-LINE/m-p/137983#M28385 <P>If you watch the wire data via tcpdump, you will see syslog events contain the log priority at the beginning of an event:</P> <PRE><CODE>&lt;134&gt;12/1/14 10:02:03.123 INFO some log info </CODE></PRE> <P>When defining LINE_BREAKER for this log, do I need to factor in the priority, or is that stripped before that stage?</P> Mon, 01 Dec 2014 16:02:14 GMT twinspop 2014-12-01T16:02:14Z For UDP inputs, does the raw log priority factor into LINE_BREAKER? https://community.splunk.com/t5/Getting-Data-In/For-UDP-inputs-does-the-raw-log-priority-factor-into-LINE/m-p/137983#M28385 <P>If you watch the wire data via tcpdump, you will see syslog events contain the log priority at the beginning of an event:</P> <PRE><CODE>&lt;134&gt;12/1/14 10:02:03.123 INFO some log info </CODE></PRE> <P>When defining LINE_BREAKER for this log, do I need to factor in the priority, or is that stripped before that stage?</P> Mon, 01 Dec 2014 16:02:14 GMT https://community.splunk.com/t5/Getting-Data-In/For-UDP-inputs-does-the-raw-log-priority-factor-into-LINE/m-p/137983#M28385 twinspop 2014-12-01T16:02:14Z Re: For UDP inputs, does the raw log priority factor into LINE_BREAKER? https://community.splunk.com/t5/Getting-Data-In/For-UDP-inputs-does-the-raw-log-priority-factor-into-LINE/m-p/137984#M28386 <P>Based on my own experiments, no, do not account for the log priority identifier in angle brackets. Pretend like it's not there.</P> Tue, 02 Dec 2014 21:47:15 GMT https://community.splunk.com/t5/Getting-Data-In/For-UDP-inputs-does-the-raw-log-priority-factor-into-LINE/m-p/137984#M28386 twinspop 2014-12-02T21:47:15Z