Getting Data In

Best way to write syslog to a file on windows?

Jason
Motivator

According to the wiki the best practice for syslog is having another program write the files to disk then have Splunk monitor the files.

What are some good programs you (or your clients) have used to accomplish this?

1 Solution

ftk
Motivator

I have used both Kiwi Syslog Daemon and syslog-win32 with success on Windows.

If you like GUIs use Kiwi. Free version of Kiwi will let you use only a single log file though -- you will have to split by host at index time using props.conf and transforms.conf. Set up Kiwi to log to file in the Kiwi format "ISO yyyy-mm-dd Tab Delimited". Then use the following config stanzas:

inputs.conf:

[monitor://E:\Syslogd\Logs\SyslogCatchAll.txt]
sourcetype = local_syslog
source = syslog
disabled = 0

props.conf:

[local_syslog]
TRANSFORMS-localsyslog=set_local_syslog_hostname
SHOULD_LINEMERGE = false

transforms.conf:

[set_local_syslog_hostname]
DEST_KEY = MetaData:Host
REGEX = \d+\-\d+\-\d+\s+\d+:\d+:\d+\s+[\w\.]+\s+([\w\.]+)\s
FORMAT = host::$1

View solution in original post

ftk
Motivator

I have used both Kiwi Syslog Daemon and syslog-win32 with success on Windows.

If you like GUIs use Kiwi. Free version of Kiwi will let you use only a single log file though -- you will have to split by host at index time using props.conf and transforms.conf. Set up Kiwi to log to file in the Kiwi format "ISO yyyy-mm-dd Tab Delimited". Then use the following config stanzas:

inputs.conf:

[monitor://E:\Syslogd\Logs\SyslogCatchAll.txt]
sourcetype = local_syslog
source = syslog
disabled = 0

props.conf:

[local_syslog]
TRANSFORMS-localsyslog=set_local_syslog_hostname
SHOULD_LINEMERGE = false

transforms.conf:

[set_local_syslog_hostname]
DEST_KEY = MetaData:Host
REGEX = \d+\-\d+\-\d+\s+\d+:\d+:\d+\s+[\w\.]+\s+([\w\.]+)\s
FORMAT = host::$1
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...