Problem Ingesting Syslogs

[staufenj]

We recently installed Splunk v4.3.1 in our Development environment and started sending it Syslogs from our Network Appliances and ESXi server only to discover that some of the events being captured are being parsed into pieces. For example:

19:15 [print__args    ]    LD____LIBRARY__PATH=/lib:/usr/lib:/opt/vmware/aam/lib:/opt/vmware/vpxa/vpx:

In other instances it appears that a single event is being broken out into 4 or more pieces making the records worthless... Digging a little deeper by clicking on the down arrow shows more of the message and seems to indicate that its treating each line as a seperate record, even then the information displayed is not complete.

Any ideas?

[staufenj]

Added the lines specified but set SHOULD_LINEMERGE = False and it seems to be working now (for VMWare). Previous settings in Local/props.conf was blank except for REPORT-Syslog = Syslog-extractions. Still waiting for switch traffic to be turned back on...

[Paolo_Prigione]

I think it might be a combination of splunk...

• not being able to identify the timestamp of the event (your example only has the time, not the date)
• assuming syslog is single lined, which it generally is, while in your case it might not be

You could try redefining the syslog input in local/props.conf as

[syslog]
TIME_FORMAT = %H:%M
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = True