Is there a document about making a Syslog message stream "Splunk-friendly"?

[CharlesM2]

I am responsible for an "agent" that sends Syslog messages to a variety of SIEMs and similar software. I have based on trial-and-error introduced some options that seem to make it more "Splunk-friendly." Is there a document that would help with this effort?

[CharlesM2]

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

[CharlesM2]

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

[CharlesM2]

Great stuff! Thanks! I am doing all of the stuff in the early paragraphs of "Logging Best Practices." I am not using commas but I could trivially -- do commas really help? (I am just using spaces.) Everything is

keyword
label=value
label="value with embedded blanks"

separated by spaces.

What about embedded quotation marks in quoted strings? What is the standard?

label="As the saying goes, \"a stitch in time saves nine\""
label="As the saying goes, ""a stitch in time saves nine"""
label='As the saying goes, "a stitch in time saves nine"'

For Syslog data that is standard RFC 3164: mmm dd hh:mm:ss hostname and then the tag=value formats above, what should be the pretrained source type?

Thanks again. Don't see a "mark as answer" button.

[yannK]

for quoted strings ,the standard should be

label="As the saying goes, \"a stitch in time saves nine"
OR

label='As the saying goes, "a stitch in time saves nine"'


[lguinn2]

To "mark as answered" just click the check-mark outline.

[lguinn2 · Accepted solution]

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!