Archive
Highlighted

Help with syslog tranforms/props

Champion

Hi,

I've inherited a splunk environment where the syslog needs a fair amount of clean-up. The incoming syslog messages are all types - servers, appliances, routers, switches.... Where possible, I route them using syslog-ng, and then do standard splunk processing. For anything that isn't caught, we route it to an "unknown" index, and I was thinking of adding props/transforms for some of these, so that I don't need to keep adding individual entries in syslog-ng.

Is there a way to add a props/transforms to look for standard cisco ios entries and routing them? The regex is "%[A-Z]+-[0-9]-[A-Z]+:".

I'm not sure how to add that to a transforms and route it.

Thanks!

0 Karma
Highlighted

Re: Help with syslog tranforms/props

Influencer

Take a look at this answer and see if it gets you started.

You can find applicable documentation here.

0 Karma
Highlighted

Re: Help with syslog tranforms/props

Champion

Thanks. I understand the concept of transforms, just need help with the regex. Can that actual regex be placed in the transforms?

REGEX = %[A-Z]+-[0-9]-[A-Z]+:

What happens if it doesn't meet the regex extraction?

0 Karma
Highlighted

Re: Help with syslog tranforms/props

Influencer

Yes, the REGEX key is there for you to specify the RegEx you want to apply.
If the RegEx match fails, the original index configured for the sourcetype will take effect. If you don't have an index predefined, the default index will be used. Unless you changed it, that's the main index.

If you are asking about the correct RegEx to identify standard Cisco log events, I'm afraid I can't help you. Maybe you can find some gems in any of the available TAs for Cisco products.

0 Karma
Highlighted

Re: Help with syslog tranforms/props

Ultra Champion

Also, being aware of the lastChanceIndex could end up being strategic for your approach here. See it in http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf. You may find it helps you capture events for which you've yet to define an index or transforms stanza.

0 Karma
Highlighted

Re: Help with syslog tranforms/props

Ultra Champion
0 Karma