topic Re: Setting "no_priority_stripping = true" in inputs.conf does not line break my events correctly. How to edit my configurations? in Getting Data In

Setting "no_priority_stripping = true" in inputs.conf does not line break my events correctly. How to edit my configurations?

_smp_ — Tue, 29 Sep 2020 13:16:52 GMT

Hi. I need to add no_priority_stripping = true to my UDP syslog input so that I can create a lookup for the facility and priority fields. But when I do this, line breaking doesn't work properly. What I'd like to do is LINE_BREAKER = (<\d+>), but of course, this strips out the characters that I need for the lookup. How do I configure this input to break on that regex, but retain those characters in the event?

Here are some sample events:

<85>Mar 21 13:16:22 C220-FCH1922V34X AUDIT[17179]: Login success (user:iseadmin, ip:192.168.10.10, service:sshd)
<85>Mar 21 13:16:22 C220-FCH1922V34X AUDIT[17179]: Session open (user:iseadmin, ip:192.168.10.10, id:63, type:CLI)
<85>Mar 21 13:16:53 C220-FCH1922V34X AUDIT[17180]: Session close (user:iseadmin, ip:192.168.10.10, id:63, type:CLI)

My goal is to lookup for the value 85 and return two new fields. And this will work, if I can get the lines to break as I described above:
syslog_facility=authpriv
syslog_severity=notice

Re: Setting "no_priority_stripping = true" in inputs.conf does not line break my events correctly. How to edit my configurations?

woodcock — Tue, 21 Mar 2017 14:33:13 GMT

You really need to show sample events.

Re: Setting "no_priority_stripping = true" in inputs.conf does not line break my events correctly. How to edit my configurations?

mtolbert_kgi — Tue, 29 Sep 2020 14:55:34 GMT

According to inputs.conf.spec (https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf) if no_priority_stripping is set to true it causes instance to NOT strip the syslog field from received events. However, for breaking events correctly try creating a new sourcetype in your props.conf file as such:

[new_source_type]
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = <\d+>
LINE_BREAKER = ^
SHOULD_LINEMERGE = false
TRUNCATE = 5000

where:

MAX_TIMESTAMP_LOOKAHEAD, TIME_PREFIX, TIME_FORMAT and SHOULD_LINEMERGE controls line breaking. Note TRUNCATE is thrown in for best practice purpose only.

Then inside your inputs.conf add this statement underneath the stanza for your input:

sourcetype=new_source_type