Splunk Indexer stripping out fields when receiving data from SplunkLF Client

[balbano]

Apparently my indexer is stripping out the syslog-ng flag fields ([INFO], [WARNING], and [CRIT]) when indexing syslog-ng logs it receives from a Splunk Light Indexer. Any reason for this? Do I need to do anything to inputs.conf or put an entry in props.conf or transforms.conf? Any help would be appreciated.

Thanks!!!

Brian

[Genti]

You did ./splunk restart after you edited your config file, aye? (sorry for asking, but you have no idea how many forget to do it..)

[balbano]

i modded the config via deployment server, which is suppose to do a splunk restart after receiving config changes, so it should have worked. Maybe I'll try to test by rebooting from the light forwarder itself to see if that fixes the issue. Thanks.

[balbano]

wolverine, doesn't look like it worked for me.... here is the snippet I appended to the default Splunk LF inputs.conf file which I am deploying to my forwarders:

[monitor:///var/log/]
disabled = false
index = sec
no_priority_stripping = true

Is that not correct? Pls. confirm. Thanks.

[balbano]

gkanapathy, I have tested this with having splunk receive syslog-ng traffic directly on UDP 514 and it did not fix the problem. Any other ideas that I can investigate? Let me know. Thanks.

[balbano]

gkanapathy, I have my Splunk Light Forwarders sending syslog-ng logs to the central indexers via TCP 9996 (over SSL). I have never modified default transform.conf file. So I'm not really sure. I just happened to notice when comparing the logs locally to the system to what the Splunk Indexer was outputing in the Search App.

Not really sure honestly. I'll keep messing with it I guess.

Brian

[gkanapathy]

no_priority_stripping is only relevant on UDP (syslog) inputs. It won't affect file data. I find it unlikely that fields are actually being removed from the files themselves however, unless you've got a specific TRANSFORM or SEDCMD rule to do it. Are you mixing config and input types with your questions? The behavior and config for "monitor:" vs "udp:" is different.

[the_wolverine]

In your inputs.conf, try setting the following for your udp/syslog input:

no_priority_stripping = true

Otherwise, syslog priority is stripped by default.

[the_wolverine]

This is a inputs.conf setting that goes on your lightforwarder.

[balbano]

for the indexer or the deployment client?