https://community.splunk.com/t5/Getting-Data-In/Split-data-into-sourcetypes-based-on-syslog-Facility-code/m-p/37565#M6921 <P>I'm about to help a client get some data split into different sourcetypes from syslog, based on a facility code set by the device. </P> <P>Assuming I turn on <CODE>no_priority_stripping</CODE> in the udp input, is there a more elegant solution than just regexing off of _raw to split this out? Or are facility/priority codes not pulled out at index time?</P> Thu, 03 Feb 2011 04:20:59 GMT Jason 2011-02-03T04:20:59Z https://community.splunk.com/t5/Getting-Data-In/Split-data-into-sourcetypes-based-on-syslog-Facility-code/m-p/37565#M6921 <P>I'm about to help a client get some data split into different sourcetypes from syslog, based on a facility code set by the device. </P> <P>Assuming I turn on <CODE>no_priority_stripping</CODE> in the udp input, is there a more elegant solution than just regexing off of _raw to split this out? Or are facility/priority codes not pulled out at index time?</P> Thu, 03 Feb 2011 04:20:59 GMT https://community.splunk.com/t5/Getting-Data-In/Split-data-into-sourcetypes-based-on-syslog-Facility-code/m-p/37565#M6921 Jason 2011-02-03T04:20:59Z https://community.splunk.com/t5/Getting-Data-In/Split-data-into-sourcetypes-based-on-syslog-Facility-code/m-p/37566#M6922 <P>They are not handled specially, so you'd need to use a regular expression against the _raw data.</P> Thu, 03 Feb 2011 05:21:58 GMT https://community.splunk.com/t5/Getting-Data-In/Split-data-into-sourcetypes-based-on-syslog-Facility-code/m-p/37566#M6922 gkanapathy 2011-02-03T05:21:58Z