Dashboards & Visualizations

Why is Splunk sending logs splitted?

harunglec
New Member

I am trying to send logs from Splunk Enterprise Instance to external server(Syslog, ELK vb.) But Splunk is sending logs splitted. For example computer name in one log and eventcode in another. What is cause of this problem?

alt text

Tags (1)
0 Karma

woodcock
Esteemed Legend

You have not told us anything about EXACTLY HOW you are forwarding the logs. Without this we cannot possibly help.

0 Karma

harunglec
New Member

I wrote both TCP and Syslog servers(IP:port) and also I added sendCookedData = false. But both of them(Syslog and TCP) are getting logs line by line. Is there any way to get logs as JSON or XML format? Or If you have any idea, You can tell me.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...