OpenText NetIQ Logs onboarding via syslog

[tech_g706]

Hi All,

Anyone who has worked with OpenText NetIQ Logs before?

We are receiving the NetIQ logs via syslog, but the sourcetype is set as default 'syslog', and field extractions are not performed properly.

Since I do not find any Splunk TA for NetIQ logs, I would need some suggestions for the source type assignment for NetIQ logs.  Thank you

[tech_g706]

@livehybrid  @kiran_panchavat  thank you very much.

| set the props like this, and field extractions are fine now.

[netiq]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)<\d+>
TIME_PREFIX = rt=
TIME_FORMAT = %s%3N
MAX_TIMESTAMP_LOOKAHEAD = 20
KV_MODE = auto
TRUNCATE = 99999

[kiran_panchavat]

@tech_g706 

You’re welcome! I’m glad to hear the props configuration worked as expected

[livehybrid · Accepted solution]

Hi @tech_g706 

The issue here is that syslog arrives with the default syslog sourcetype and you shouldnt start applying field extractions to a default sourcetype.

Do you use the syslog input for any other feeds? If you dont use it for other feeds then one thing you could do is change/specify the sourcetype in the syslog input stanza to something specific to something like "netiq:log" and then you can apply your relevant props/transforms based on this sourcetype.

However, if you are you using the syslog input for other feeds too then you would need to use some other props/transforms to determine IF it is netIQ and then apply props accordingly, such as changing the sourcetype for that data.

The other thing which you might want to look at is using Splunk for Syslog (SC4S) which supports the CEF format that NetIQ is sending, check out the relevant SC4S docs here 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@tech_g706 

The default syslog sourcetype is too generic and often leads to improper parsing, as it’s not tailored to specific log formats like NetIQ. Instead, create a custom sourcetype to handle the unique structure of NetIQ logs.

1. Review the Answers post

Solved: What are the best practices for defining source ty... - Splunk Community

Reference: 

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Listofpretrainedsourcetypes 

https://kinneygroup.com/blog/splunk-magic-8-props-conf/