Getting Data In

Splunk Indexer stripping out fields when receiving data from SplunkLF Client

balbano
Contributor

Apparently my indexer is stripping out the syslog-ng flag fields ([INFO], [WARNING], and [CRIT]) when indexing syslog-ng logs it receives from a Splunk Light Indexer. Any reason for this? Do I need to do anything to inputs.conf or put an entry in props.conf or transforms.conf? Any help would be appreciated.

Thanks!!!

Brian

0 Karma

Genti
Splunk Employee
Splunk Employee

You did ./splunk restart after you edited your config file, aye? (sorry for asking, but you have no idea how many forget to do it..)

0 Karma

balbano
Contributor

i modded the config via deployment server, which is suppose to do a splunk restart after receiving config changes, so it should have worked. Maybe I'll try to test by rebooting from the light forwarder itself to see if that fixes the issue. Thanks.

0 Karma

balbano
Contributor

wolverine, doesn't look like it worked for me.... here is the snippet I appended to the default Splunk LF inputs.conf file which I am deploying to my forwarders:

[monitor:///var/log/]
disabled = false
index = sec
no_priority_stripping = true

Is that not correct? Pls. confirm. Thanks.

0 Karma

balbano
Contributor

gkanapathy, I have tested this with having splunk receive syslog-ng traffic directly on UDP 514 and it did not fix the problem. Any other ideas that I can investigate? Let me know. Thanks.

0 Karma

balbano
Contributor

gkanapathy, I have my Splunk Light Forwarders sending syslog-ng logs to the central indexers via TCP 9996 (over SSL). I have never modified default transform.conf file. So I'm not really sure. I just happened to notice when comparing the logs locally to the system to what the Splunk Indexer was outputing in the Search App.

Not really sure honestly. I'll keep messing with it I guess.

Brian

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

no_priority_stripping is only relevant on UDP (syslog) inputs. It won't affect file data. I find it unlikely that fields are actually being removed from the files themselves however, unless you've got a specific TRANSFORM or SEDCMD rule to do it. Are you mixing config and input types with your questions? The behavior and config for "monitor:" vs "udp:" is different.

0 Karma

the_wolverine
Champion

In your inputs.conf, try setting the following for your udp/syslog input:

no_priority_stripping = true

Otherwise, syslog priority is stripped by default.

0 Karma

the_wolverine
Champion

This is a inputs.conf setting that goes on your lightforwarder.

0 Karma

balbano
Contributor

for the indexer or the deployment client?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...