Getting Data In
Highlighted

Is there a document about making a Syslog message stream "Splunk-friendly"?

Engager

I am responsible for an "agent" that sends Syslog messages to a variety of SIEMs and similar software. I have based on trial-and-error introduced some options that seem to make it more "Splunk-friendly." Is there a document that would help with this effort?

0 Karma
Highlighted

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

Legend

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!

View solution in original post

Highlighted

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

Engager

Great stuff! Thanks! I am doing all of the stuff in the early paragraphs of "Logging Best Practices." I am not using commas but I could trivially -- do commas really help? (I am just using spaces.) Everything is

keyword
label=value
label="value with embedded blanks"

separated by spaces.

What about embedded quotation marks in quoted strings? What is the standard?

label="As the saying goes, \"a stitch in time saves nine\""
label="As the saying goes, ""a stitch in time saves nine"""
label='As the saying goes, "a stitch in time saves nine"'

For Syslog data that is standard RFC 3164: mmm dd hh:mm:ss hostname and then the tag=value formats above, what should be the pretrained source type?

Thanks again. Don't see a "mark as answer" button.

0 Karma
Highlighted

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

Legend

To "mark as answered" just click the check-mark outline.

0 Karma
Highlighted

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

Splunk Employee
Splunk Employee

for quoted strings ,the standard should be

label="As the saying goes, \"a stitch in time saves nine"
OR

label='As the saying goes, "a stitch in time saves nine"'

Highlighted

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

Engager

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

0 Karma
Highlighted

Re: Is there a document about making a Syslog message stream "Splunk-friendly"?

Engager

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

0 Karma