Getting Data In

A number is added to log entries collected through universal forwarder using sourcetype syslog.

rubenmuradyan
Explorer

Hi,

I'm collecting syslog events from network to a dedicated universal forwarder using a TCP input on forwarder. 

In my Splunk installation I get all the syslog entries, but there's a number in angled brackets (<149>, for example) added to the beginning of every log entry added to Splunk index. That number is not always <149>, it changes, but I cannot find the logic behind those changes.

Screenshot from 2021-12-01 13-29-00.png

That angled bracketed number does not allow to implement correct field extraction.

So my question is: how do I get rid of that number in angled brackets? Shall it be done on forwarder? 

I'm sorry if my question is stupid, or is well-covered in documentation, I'm relatively new to Splunk and learning now.

 

Thank you!

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

that value is combination of syslog facility and priority. You could see it e.g. from here 6.2.1 (RFC)

If you don't need it you could remove it on Indexer (actually first Full Splunk Enterprise instance e.g. HF in your flow) with props.conf with sed or using also transforms.conf if you want do something more at same time.

If you are using UDP (don't use ;-), there is parameter in inputs.conf which can manage it. But as we know udp always lost some packets, it's not good idea to use it. Actually it will be best to use some real syslog server and then use UF for reading events from file instead of receiving those directly with UF/HF.

https://community.splunk.com/t5/Getting-Data-In/Why-is-each-line-of-syslog-prepended-with-a-number-i...

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

that value is combination of syslog facility and priority. You could see it e.g. from here 6.2.1 (RFC)

If you don't need it you could remove it on Indexer (actually first Full Splunk Enterprise instance e.g. HF in your flow) with props.conf with sed or using also transforms.conf if you want do something more at same time.

If you are using UDP (don't use ;-), there is parameter in inputs.conf which can manage it. But as we know udp always lost some packets, it's not good idea to use it. Actually it will be best to use some real syslog server and then use UF for reading events from file instead of receiving those directly with UF/HF.

https://community.splunk.com/t5/Getting-Data-In/Why-is-each-line-of-syslog-prepended-with-a-number-i...

r. Ismo

rubenmuradyan
Explorer

Thank you so much, @isoutamo  for your reply!

I've opened TCP receiver on TCP/1100 (I already have lessons learned with UDP 🙂 ) on universal forwarder and was collecting logs from it.

Will follow your advice.

Thank you again!

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...