All Apps and Add-ons

How do you verify whether ingested syslog data had headers or not?

kaumiladani
New Member

While ingesting data from 3rd party products, if syslog data is being indexed, does Splunk automatically strip the header?

In Splunk documentation, it states that the following parameter must be used in inputs.conf:

**no_priority_stripping = true | false (default: false)**

Also, how do I verify whether the actual syslog data that is being ingested had headers in the original data or not? Considering, there were no headers being shown in Splunk.

Tags (1)
0 Karma

FrankVl
Ultra Champion

The priority stripping only refers to the <123> part at the start of syslog messages (the priority code that encapsulates the syslog facility and severity).

If you want to find out what the original data looked like, your best bet is probably to run a network capture tool like tcpdump or so on the forwarder, to see what the incoming data looks like. Or check out the configuration / documentation of the source device to figure out what format it sends out.

PS: in general it is considered best practise to not send syslog data straight to a Splunk TCP or UDP input, but rather send it to a syslog server (rsyslog / syslog-ng) and have that syslog daemon write the logs to file. And then run a forwarder on that same system that ingests those files with a file monitor input.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Syslog doesn't use headers.
The no_priority_stripping attribute is not related to headers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

FrankVl
Ultra Champion

That depends a bit on your definition of headers.

The <123>timestamp hostname part that you will typically find at the start of a syslog message is often referred to as the syslog header.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...