Getting Data In

Parsing syslog, extracting all the basic fields, while setting correct timestamp - is it possible?

OlegB
New Member

I wonder if there is a way of parsing/searching syslog messages, simpler than editing config files, and writing applications? RFC 5424 is a well known standard, after all? Why isn't it possible to search (or even see) the most important fields, priority and facility?
Is there something I'm missing?

0 Karma

Ayn
Legend

Regarding timestamp extraction, see this section of the docs: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

If you don't want Splunk to use the time when the events were actually generated, you could tell it to use the index time instead (an option which itself has its dangers). A better approach imho would be to specify which timezones your sources have, which makes Splunk adjust its timestamp accordingly automatically.

As you discovered, by default Splunk will strip syslog headers. You can easily change this behaviour by specifying no_priority_stripping = true in the relevant section of your inputs.conf. Other than that Splunk indexes the raw events, which is why I was confused by what you said about messages being shown the way they're supposed to be seen - because if the original raw data is not how it's supposed to be seen, what IS the "correct" way to show it?

0 Karma

OlegB
New Member

Thanks, Ayn
The source of confusion may be the syslog format itself, mixing of encoded (priority/facility) and text fields.

0 Karma

OlegB
New Member

Timestamp gets taken from syslog message, which may be specified in different time zone, say, UTC. So I can't see the messages if search, say, for the last hour.
RFC defines format quite well. Priority, facility, and a set of standard fields. Currently, to see those I need to install an app, and search with a three line query. Doesn't seem right for an RFC specified format.

0 Karma

Ayn
Legend

What do you mean by not translating the timestamp to local?

EDIT: ...and what do you mean by showing the messages "the way they're supposed to be seen"? What way is that?

OlegB
New Member

So I downloaded RFC5424 Syslog app. To get severity and facility decoded, I need to set no_priority_stripping=yes in the config files, but this setting effectively kills the value of the syslog timestamp, by not translating it to local.
Is there any way to show the messages the way they're supposed to be seen?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...