Getting Data In

Cannot parse linux logs

meg
Observer

My linux logs cannot parsed in dashboard. My renderxml is setted to false

meg_0-1751025147247.png

 

Labels (3)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @meg 

Please can you confirm the sourcetype that you are using?

Also, is this being read directly using a UF and sent to Splunk without going via other systems? 

Are you ingesting this using the Splunk Add-on for Sysmon for Linux on the UF?

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

kiran_panchavat
Champion

@meg Please verify your sourcetype, The Splunk Add-on for Sysmon for Linux supports the following source types:

sysmon:linux 
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
Champion

@meg 

renderXml = false

This setting is typically used in Universal Forwarder or inputs.conf for Windows Event Logs. If you're forwarding Linux logs, this setting might not be relevant unless you're using it in a specific context.

Have you installed the below add-on to parse the data? Can you share your inputs.conf file here. 

https://splunkbase.splunk.com/app/6652 

https://docs.splunk.com/Documentation/AddOns/released/NixSysmon/Sourcetypes 

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...