Getting Data In

Problem Ingesting Syslogs

staufenj
New Member

We recently installed Splunk v4.3.1 in our Development environment and started sending it Syslogs from our Network Appliances and ESXi server only to discover that some of the events being captured are being parsed into pieces. For example:

19:15 [print__args    ]    LD____LIBRARY__PATH=/lib:/usr/lib:/opt/vmware/aam/lib:/opt/vmware/vpxa/vpx:

In other instances it appears that a single event is being broken out into 4 or more pieces making the records worthless... Digging a little deeper by clicking on the down arrow shows more of the message and seems to indicate that its treating each line as a seperate record, even then the information displayed is not complete.

Any ideas?

Tags (2)
0 Karma

staufenj
New Member

Added the lines specified but set SHOULD_LINEMERGE = False and it seems to be working now (for VMWare). Previous settings in Local/props.conf was blank except for REPORT-Syslog = Syslog-extractions. Still waiting for switch traffic to be turned back on...

0 Karma

Paolo_Prigione
Builder

I think it might be a combination of splunk...

  • not being able to identify the timestamp of the event (your example only has the time, not the date)
  • assuming syslog is single lined, which it generally is, while in your case it might not be

You could try redefining the syslog input in local/props.conf as

[syslog]
TIME_FORMAT = %H:%M
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = True
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...