topic Re: How to identify type of log delivery in Getting Data In

How to identify type of log delivery

evelenke — Thu, 06 Feb 2020 15:07:40 GMT

Hi Splunkers,

we have centralized syslog collector.
Also many hosts deliver logs via UFs directly.
The same index may contain data delivered from UFs and from syslog inputs.
Also we have DB connectors and APIs.
Is it possible to divide data by type of input? Does Splunk have this kind of inspection?

Re: How to identify type of log delivery

nickhills — Thu, 06 Feb 2020 15:15:45 GMT

source or sourcetype should be the differentiators.

Is this not sufficent for your needs?

Re: How to identify type of log delivery

gcusello — Thu, 06 Feb 2020 15:16:10 GMT

Hi @evelenke,
you should divide them by source field:

syslogs have TCP:port or UDP:port;
Universal Forwarder have the file or the script or the module;
DB-Connect has db... (I'm not sure about this but you can check easily!).

Ciao.
Giuseppe

Re: How to identify type of log delivery

evelenke — Fri, 07 Feb 2020 09:37:34 GMT

May be custom

Re: How to identify type of log delivery

nickhills — Fri, 07 Feb 2020 09:40:18 GMT

Can you provide some examples?

Re: How to identify type of log delivery

evelenke — Fri, 07 Feb 2020 16:48:53 GMT

You can set index, source and sourcetype in inputs.conf on UF or DB Connect.
In this case you may\should have a big knowledge base and control everything.

I need something more simplistic like IP addresses or actual hostname of a source where logs were delivered from, is there's any option to track this?

Re: How to identify type of log delivery

evelenke — Fri, 07 Feb 2020 16:49:38 GMT

Hi @gcusello ,

everything may be custom - You can set index, source and sourcetype in inputs.conf on UF or DB Connect.
In this case you may\should have a big knowledge base and control everything.

I need something more simplistic like IP addresses or actual hostname of a source where logs were delivered from, is there's any option to track this?

Re: How to identify type of log delivery

gcusello — Fri, 07 Feb 2020 18:48:34 GMT

Hi @evelenke,
as you said, IP or hostname could be not useful if you can receive from a server both by Universal Forwarder or syslog.
You can easily identify syslogs (TCP:514 or UDP:514) and DB-Connect (db...), the others are different but they always come from Universal Forwarder.
Another way to identify sources from Universal Forwarders is that you surely have also logs from these servers in _internal.

Ciao.
Giuseppe