Getting Data In

Information missing on Splunk syslog

Path Finder


I have a network device that sends to Splunk syslog messages using udp 514. The messages are like:

Wed Jun 13 17:37:09 2012: <182>receive event capwap disconnect: eventid = 88: length = 0
Wed Jun 13 17:37:46 2012: <182>[wifi]: wifi0: reduce CCA to 49
Wed Jun 13 17:37:51 2012: <182>CAPWAP: capwap predefine server name file isn't exist.
(this messages are captued using tftpd32 syslog server)

When I receive these messages in Splunk I see that string "<182>" is missed. I used "Show source" option search view, and I got this messages:

Jun 13 17:37:09 receive event capwap disconnect: eventid = 88: length = 0
Jun 13 17:37:46 [wifi]: wifi0: reduce CCA to 49
Jun 13 17:37:51 CAPWAP: capwap predefine server name file isn't exist.

Does anyone know what's happening?


Tags (1)
0 Karma
1 Solution

Path Finder

To elaborate on the earlier answer:

By default, splunk strips the syslog priority from incoming syslog messages.

to stop this behavior, add "no_priority_stripping = true" to your syslog source.

there is an app on splunkbase syslog_priority_lookup that will extract this and create facility and severity fields at search time - very useful information.

0 Karma

Path Finder

I can see in the network capture that <182> is the syslog level info.
It seems Splunk does not analyse syslog protocol correctly.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...