topic Re: Windows event log Splunk HF with truncation in Other Usage

Windows event log Splunk HF with truncation

sarvananth — Sun, 28 Jan 2024 14:19:29 GMT

We are using Splunk Universal Forwarder (UF) to forward logs from a Windows server to a Splunk Heavy Forwarder (HF). However, when the Splunk HF receives logs of a specific type as multiline, an issue arises. In this case, when attempting to forward these logs from the Splunk HF to a syslog server (a Linux server with rsyslog configuration), the logs are getting truncated. How can we address and resolve this issue?

Re: Windows event log Splunk HF with truncation

richgalloway — Sun, 28 Jan 2024 15:20:30 GMT

The screenshot shows an untruncated event. What makes you believe the logs are getting truncated? Please show a sanitized sample truncated event.

Why are the events going from a Splunk HF to a syslog server instead of to a Splunk indexer?

Re: Windows event log Splunk HF with truncation

tscroggins — Sun, 28 Jan 2024 18:21:50 GMT

Hi @sarvananth,

Have you reviewed rsyslog documentation for maximum message length and line endings? If you're forwarding using a syslog output over UDP, the transport itself has a limit of 65,535 bytes per datagram (subtract headers for maximum payload length). You may also want to transform the events by replacing line endings with an escape sequence of your choosing (or one required by the consumer).

Re: Windows event log Splunk HF with truncation

sarvananth — Sun, 28 Jan 2024 22:57:51 GMT

please check the truncated event from syslog server

We are attempting to send logs to both the Splunk indexer and the syslog server because different teams handle distinct log types. My team manages the system security logs specifically for SOC team monitoring.

Re: Windows event log Splunk HF with truncation

JunYamaguchi — Thu, 22 Aug 2024 15:58:55 GMT

This can be caused by syslog not supporting newlines(\n).
The following settings on the HF will improve this.

props.conf [your-sourcetype] TRANSFORMS-◯◯ = transname transforms.conf [transname] INGEST_EVAL = _raw=replace(_raw, "\n", " ")