Getting Data In

Splunk 6.0 removing syslog priority fields

herat420
New Member

Dear sir

I have read all information on the Splunk answers. but I couldnt find any solutionn for my situation. I am new in the world of splunk and splunk is running in test lab. I can forward syslog to splunkm but splunk remove priority fields from syslog. I have add the following code in the inpust.conf file and restart the splunk, but it didnt solved my problem.

C:\Program Files\Splunk\etc\system\local\inputs.conf
[udp://514]
no_priority_stripping = true

I tried also this location:
C:\Program Files\Splunk\etc\apps\search\local\inputs.conf
[udp://514]
no_priority_stripping = true

Would anyone please tell me if am i configuring in the worng place?
If anyone can help me I would apprecaite that.
thanks in advance

Best Rrgards,

Herat

0 Karma

rkirkw
Path Finder

In 6 on Windows with the Universal Forwarder, it seems that the config files have moved to
C:\splunkuniversalforwarder\etc\apps\splunk_ta_windows\local\inputs.conf

This is the file I had to change to point the data to specific indexes.

You may try a search for other inputs.conf and see if you have one in a similar location - depending on the path you chose for $Splunk_Home

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk ...

Federated Search for Cisco  Security Analytics and Logging (SAL) is now generally available as part of the ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Join us for a demo-driven look at how ...