topic Re: Syslog data source and Splunk 5.0.3 on Windows 2008 in Getting Data In

Syslog data source and Splunk 5.0.3 on Windows 2008

mas — Wed, 14 Aug 2013 09:07:44 GMT

After the upgrade to Splunk 5.0.3, my syslog data sources suddenly stopped to work. Using MS Network Monitor and Wireshark, I am able to see syslog packets reaching the server. Upgrading to 5.0.4 did not resolve the issue.

Splunk is installed on a Windows 2008 R2 machine.

Anyone experiencing the same problem?

Re: Syslog data source and Splunk 5.0.3 on Windows 2008

alacercogitatus — Thu, 15 Aug 2013 17:24:37 GMT

Can you verify your inputs? Did you make changes in a default/inputs.conf file? They may have been overwritten. Does the input appear in the manager?

Re: Syslog data source and Splunk 5.0.3 on Windows 2008

mas — Mon, 19 Aug 2013 06:56:51 GMT

Hi alacercogitatus, thank you for your answer. I never change conf files in "default" folders. The input appears in the manager. In addition, I tried to install a syslog server (temporary disabling the input source) and syslog messages were traced correctly.

It seems that Splunk is refusing to collect data for this data source.

Re: Syslog data source and Splunk 5.0.3 on Windows 2008

mas — Mon, 19 Aug 2013 09:10:08 GMT

I found the problem. The same day of the update, a configuration change had been made in props.conf (under ./etc/system/local). A stanza had been created to match data sent by three specific hosts (just say: serverA, serverB and serverC). There was a typo in this stanza name! It had been defined as:

[host::serverA|host::serverB||host::serverC]

instead of

[host::serverA|host::serverB|host::serverC]

The double "||" caused a "match-all" situation. In addition, this stanza has a conditional redirect of all the events, with the exception of the required ones, to the null queue. All the syslog events, as a result, were discarded!