How to display several syslogs at the same time from different devices?

[IHG152]

Hi All

I am looking for a solution to display syslogs from three devices at the same time on the same screen in order to correlate the data. Having performed many searches I can't seem to work out the Splunk nomenclature for this (I am a newbie) . Could anybody point me in the right direction?

Many thanks

[IHG152]

Thank you for all your help 🙂

[FrankVl]

If you found my answer helpful, please mark that as accepted, rather than posting your own comment as a new answer. That way others who have the same problem can also easily find the right information 🙂

[FrankVl · Accepted solution]

That would start with writing a search query that returns all that data. What does "different devices" mean in this case, in Splunk terminology? Are those syslog events from all three devices in the same index and sourcetype, or in different ones?

If it is all in the same index and sourcetype, it would simply be something like:

index = yourindex sourcetype = yoursourcetype (host = hostA OR host = hostB or host = hostC)

If the data is in different indexes/sourcetypes, add OR clauses for those as well:

(index = indexA AND sourcetype = sourcetypeA AND host = hostA) OR  (index = indexB AND sourcetype = sourcetypeB AND host = hostB) or  (index = indexC AND sourcetype = sourcetypeC AND host = hostC)

[IHG152]

Hi FrankVI

Thank you for reply so quickly.

The idea is to have three different devices (firewall, router and switch) send their syslogs to Splunk (I have read another device is needed to collect the syslog data) and then be able to display the syslog files for each device at the same time in three different windows and then be able to correlate/view the data by time.

Is this achievable? Everything I see in syslog software always appears to be one syslog window only.

Thanks

[FrankVl]

Not sure what syslog software you are referring to, but the answer to your question is yes. Once you get this data into splunk, you can search and display it in whichever way you want. All the logs in one big list (as per the search suggestions I gave in my answer), separate windows searching each device type etc.