Getting Data In

Is there a document about making a Syslog message stream "Splunk-friendly"?

CharlesM2
Engager

I am responsible for an "agent" that sends Syslog messages to a variety of SIEMs and similar software. I have based on trial-and-error introduced some options that seem to make it more "Splunk-friendly." Is there a document that would help with this effort?

0 Karma
1 Solution

lguinn2
Legend

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!

View solution in original post

CharlesM2
Engager

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

0 Karma

CharlesM2
Engager

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

0 Karma

CharlesM2
Engager

Great stuff! Thanks! I am doing all of the stuff in the early paragraphs of "Logging Best Practices." I am not using commas but I could trivially -- do commas really help? (I am just using spaces.) Everything is

keyword
label=value
label="value with embedded blanks"

separated by spaces.

What about embedded quotation marks in quoted strings? What is the standard?

label="As the saying goes, \"a stitch in time saves nine\""
label="As the saying goes, ""a stitch in time saves nine"""
label='As the saying goes, "a stitch in time saves nine"'

For Syslog data that is standard RFC 3164: mmm dd hh:mm:ss hostname and then the tag=value formats above, what should be the pretrained source type?

Thanks again. Don't see a "mark as answer" button.

0 Karma

yannK
Splunk Employee
Splunk Employee

for quoted strings ,the standard should be

label="As the saying goes, \"a stitch in time saves nine"
OR

label='As the saying goes, "a stitch in time saves nine"'

lguinn2
Legend

To "mark as answered" just click the check-mark outline.

0 Karma

lguinn2
Legend

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!

Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...