How do keep splunk from removing syslog priority fields?

[Chris_R_]

How do keep splunk from removing syslog priority fields? They are removed once indexed into splunk.

[Chris_R_ · Accepted solution]

There is a optional flag within inputs.conf you can place in any UDP input stanza, such as

[udp://514]

no_priority_stripping = true

This will keep your priority field on any syslog events indexed into splunk via udp port 514

[Chris_R_]

Unfortunately this only works with syslog via UDP inputs.
If using a tcp input, you would have to set up a props/transforms entry to store these fields.

[balbano]

will this also work for SSL? for example:

[splunktcp-ssl:9996]
compressed = true
no_priority_stripping = true

Kindly confirm.

Thanks!

Brian