topic Help with syslog tranforms/props in Getting Data In

Help with syslog tranforms/props

a212830 — Tue, 29 Sep 2020 18:54:50 GMT

Hi,

I've inherited a splunk environment where the syslog needs a fair amount of clean-up. The incoming syslog messages are all types - servers, appliances, routers, switches.... Where possible, I route them using syslog-ng, and then do standard splunk processing. For anything that isn't caught, we route it to an "unknown" index, and I was thinking of adding props/transforms for some of these, so that I don't need to keep adding individual entries in syslog-ng.

Is there a way to add a props/transforms to look for standard cisco ios entries and routing them? The regex is "%[A-Z_]+-[0-9]-[A-Z_]+:".

I'm not sure how to add that to a transforms and route it.

Thanks!

Re: Help with syslog tranforms/props

s2_splunk — Mon, 09 Apr 2018 18:43:27 GMT

Take a look at this answer and see if it gets you started.

You can find applicable documentation here.

Re: Help with syslog tranforms/props

a212830 — Tue, 29 Sep 2020 18:54:54 GMT

Thanks. I understand the concept of transforms, just need help with the regex. Can that actual regex be placed in the transforms?

REGEX = %[A-Z_]+-[0-9]-[A-Z_]+:

What happens if it doesn't meet the regex extraction?

Re: Help with syslog tranforms/props

s2_splunk — Mon, 09 Apr 2018 19:00:42 GMT

Yes, the REGEX key is there for you to specify the RegEx you want to apply.
If the RegEx match fails, the original index configured for the sourcetype will take effect. If you don't have an index predefined, the default index will be used. Unless you changed it, that's the main index.

If you are asking about the correct RegEx to identify standard Cisco log events, I'm afraid I can't help you. Maybe you can find some gems in any of the available TAs for Cisco products.

Re: Help with syslog tranforms/props

sloshburch — Fri, 27 Apr 2018 12:13:25 GMT

Also, being aware of the lastChanceIndex could end up being strategic for your approach here. See it in http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf. You may find it helps you capture events for which you've yet to define an index or transforms stanza.

Re: Help with syslog tranforms/props

sloshburch — Fri, 27 Apr 2018 12:15:49 GMT

Cross reference to related question (I think): https://answers.splunk.com/answers/638013/help-with-setting-index-and-sourcetype-via-transfo.html