How do you verify whether ingested syslog data had headers or not?

[kaumiladani]

While ingesting data from 3rd party products, if syslog data is being indexed, does Splunk automatically strip the header?

In Splunk documentation, it states that the following parameter must be used in inputs.conf:

**no_priority_stripping = true | false (default: false)**

Also, how do I verify whether the actual syslog data that is being ingested had headers in the original data or not? Considering, there were no headers being shown in Splunk.

[FrankVl]

The priority stripping only refers to the <123> part at the start of syslog messages (the priority code that encapsulates the syslog facility and severity).

If you want to find out what the original data looked like, your best bet is probably to run a network capture tool like tcpdump or so on the forwarder, to see what the incoming data looks like. Or check out the configuration / documentation of the source device to figure out what format it sends out.

PS: in general it is considered best practise to not send syslog data straight to a Splunk TCP or UDP input, but rather send it to a syslog server (rsyslog / syslog-ng) and have that syslog daemon write the logs to file. And then run a forwarder on that same system that ingests those files with a file monitor input.

[richgalloway]

Syslog doesn't use headers.
The no_priority_stripping attribute is not related to headers.

[FrankVl]

That depends a bit on your definition of headers.

The <123>timestamp hostname part that you will typically find at the start of a syslog message is often referred to as the syslog header.