Getting Data In

How to change or add meta data for syslog facility/priority fields

infrauser
Explorer

I have a syslog box forwarding to splunk for indexing. I have the input type setup as syslog. Unfortunately, it doesn't appear that splunk automatically decodes the syslog facility/priority integer. I would like to either add this meta data to each message (preferred) or change the incoming message (less preferred) before splunk indexes it.

I found a script over at splunkbase which appears to have the logic for the decoding portion, however it looks like this script can only be used during searches.

I would prefer not to go the route of performing the decoding during searching as it seems like it would add quite a bit of overhead compared to having it already indexed with the facility/priority.

Thanks in advance for any advice.

Tags (1)
0 Karma
1 Solution

infrauser
Explorer

Following up, I've read a number of items which discourage the practice of adding fields to the index and instead using search time fields. I ended up creating a lookup file with the priorities, facilities, severity. I then created a field extraction for the syslog priority and then a transform to output the associated facility/severity. – infrauser Dec 22 at 2:07

View solution in original post

0 Karma

Jason
Motivator

Splunk can automatically decode it with the Syslog Priority Field Decoder Lookup app.

</plug>

0 Karma

infrauser
Explorer

Following up, I've read a number of items which discourage the practice of adding fields to the index and instead using search time fields. I ended up creating a lookup file with the priorities, facilities, severity. I then created a field extraction for the syslog priority and then a transform to output the associated facility/severity. – infrauser Dec 22 at 2:07

0 Karma

infrauser
Explorer

Following up, I've read a number of items which discourage the practice of adding fields to the index and instead using search time fields.

I ended up creating a lookup file with the priorities, facilities, severity. I then created a field extraction for the syslog priority and then a transform to output the associated facility/severity.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...