https://community.splunk.com/t5/Getting-Data-In/splunk-event-miss-data/m-p/500396#M85901 <P>That is expected behaviour.</P> <P>Syslog will only send the "Message" - what you are showing in your screenshot is how your syslog server renders the data for you.</P> <P>Side Note: I would be a bit alarmed that your syslog server appears to receive the message 14 -17 seconds before the client has sent it!<BR /> I'm not familiar with the tool pictured, but it might suggest you have a time sync issue to deal with.</P> Tue, 04 Feb 2020 10:07:31 GMT nickhills 2020-02-04T10:07:31Z https://community.splunk.com/t5/Getting-Data-In/splunk-event-miss-data/m-p/500395#M85900 <P>Hi <BR /> splunk event receive syslog ,but it didn'nt appear msg type.<BR /> for example <BR /> kiwisyslog or 3cdemon<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8313i87354EE93A2B3B66/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>splunk only display "Message"<BR /> thank you </P> Tue, 04 Feb 2020 05:08:38 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-event-miss-data/m-p/500395#M85900 bjlotsplunk 2020-02-04T05:08:38Z https://community.splunk.com/t5/Getting-Data-In/splunk-event-miss-data/m-p/500396#M85901 <P>That is expected behaviour.</P> <P>Syslog will only send the "Message" - what you are showing in your screenshot is how your syslog server renders the data for you.</P> <P>Side Note: I would be a bit alarmed that your syslog server appears to receive the message 14 -17 seconds before the client has sent it!<BR /> I'm not familiar with the tool pictured, but it might suggest you have a time sync issue to deal with.</P> Tue, 04 Feb 2020 10:07:31 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-event-miss-data/m-p/500396#M85901 nickhills 2020-02-04T10:07:31Z