Getting Data In

How can I escape linefeed/newline characters when forwarding Windows events to a third party via syslog?

ringm
New Member

Windows event logs are being picked up by Universal Forwarder v5 and sent to an Indexer v5.

I'm trying to forward these events to a third party for analysis. I've followed the instructions here and have events hitting my third party server on UDP 514.

Tcpdump shows the data contains newline characters. For example: ...\nLogName=Security\nSourceName=Security\n

It appears that UF picks up the newlines from the windows event log, and the built-in sourcetype creates multi-line events. But my third party server does not handle multi-line events in syslog correctly.

Is there any way to have Splunk escape/replace the newlines in the event with some other character or pattern prior to sending them to the third party over syslog?

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

The windows events logs are multiline events in Splunk.

There are no method to format the events when they are being forwarded. So the only options are :

  • bypass splunk
    collect the windows logs as syslog and send them directly to your device. (see snare and other tools)

  • format the events at indextime using SEDCMD.
    Collect the events with splunk, and remove the linebreaking characters at index time.
    The events will be forwarded as single line.
    But in splunk, they will lose the default formatting, and some field extractions may fail.
    It will have a performance cost at index time to apply the sed command.

Disclaimer : This method is a workaround and the events may not be suitable for splunk existing apps and analytics.

Here is a method in props.conf for the indexers (and heavy forwarder) to achieve it for every windows events logs.

[source::*WinEventLog*]
SEDCMD= s/[\n\r]/ /g
# remove all the line breaks

View solution in original post

yannK
Splunk Employee
Splunk Employee

The windows events logs are multiline events in Splunk.

There are no method to format the events when they are being forwarded. So the only options are :

  • bypass splunk
    collect the windows logs as syslog and send them directly to your device. (see snare and other tools)

  • format the events at indextime using SEDCMD.
    Collect the events with splunk, and remove the linebreaking characters at index time.
    The events will be forwarded as single line.
    But in splunk, they will lose the default formatting, and some field extractions may fail.
    It will have a performance cost at index time to apply the sed command.

Disclaimer : This method is a workaround and the events may not be suitable for splunk existing apps and analytics.

Here is a method in props.conf for the indexers (and heavy forwarder) to achieve it for every windows events logs.

[source::*WinEventLog*]
SEDCMD= s/[\n\r]/ /g
# remove all the line breaks

yannK
Splunk Employee
Splunk Employee

thanks jrod, answer edited

0 Karma

jrodman
Splunk Employee
Splunk Employee

Snark alert! The + on the [class] is unnecessary.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...