topic Re: Is there a document about making a Syslog message stream "Splunk-friendly"? in Getting Data In

Is there a document about making a Syslog message stream "Splunk-friendly"?

CharlesM2 — Wed, 27 Nov 2013 17:10:13 GMT

I am responsible for an "agent" that sends Syslog messages to a variety of SIEMs and similar software. I have based on trial-and-error introduced some options that seem to make it more "Splunk-friendly." Is there a document that would help with this effort?

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

lguinn2 — Wed, 27 Nov 2013 18:36:24 GMT

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

CharlesM2 — Wed, 27 Nov 2013 19:01:22 GMT

Great stuff! Thanks! I am doing all of the stuff in the early paragraphs of "Logging Best Practices." I am not using commas but I could trivially -- do commas really help? (I am just using spaces.) Everything is

keyword
label=value
label="value with embedded blanks"

separated by spaces.

What about embedded quotation marks in quoted strings? What is the standard?

label="As the saying goes, \"a stitch in time saves nine\""
label="As the saying goes, ""a stitch in time saves nine"""
label='As the saying goes, "a stitch in time saves nine"'

For Syslog data that is standard RFC 3164: mmm dd hh:mm:ss hostname and then the tag=value formats above, what should be the pretrained source type?

Thanks again. Don't see a "mark as answer" button.

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

CharlesM2 — Wed, 27 Nov 2013 19:02:55 GMT

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

CharlesM2 — Wed, 27 Nov 2013 19:03:01 GMT

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

lguinn2 — Sat, 30 Nov 2013 06:26:25 GMT

To "mark as answered" just click the check-mark outline.

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

yannK — Sat, 30 Nov 2013 16:09:45 GMT

for quoted strings ,the standard should be

label="As the saying goes, \"a stitch in time saves nine"
OR
label='As the saying goes, "a stitch in time saves nine"'