Getting Data In

Why is Splunk_TA_nix not using default sourcetypes for /var/log/messages?

daniel333
Builder

All,

I have a relatively default setup for Splunk_TA_nix on centOS 7 and /var/log/messages is coming in as sourcetype=syslog. How ever when I review the pretrained sourcetypes docs here I see that is not the correct sourcetype https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Listofpretrainedsourcetypes

Any idea what's up? Any reason I shouldn't configure this to be sourcetype=linux_messages_syslog?

thanks,
-Daniel Wilson

0 Karma

oscar84x
Contributor

If you look at the respective props and transforms for those sourcetypes, it looks like the nix add on is extracting more detailed information out of the data under the syslog sourcetype.

FROM NIX ADD-ON

###### Syslog ######
[source::....syslog]
sourcetype = syslog

[syslog]
EVENT_BREAKER_ENABLE = true

## Event extractions by type
REPORT-0authentication_for_syslog = ssh-login-events, ssh-session-close, ssh-disconnect, sshd_authentication_kerberos_success, sshd_authentication_refused, sshd_authentication_tried, sshd_login_restricted, pam_unix_authentication_success, pam_unix_authentication_failure, sudo_cannot_identify, ksu_authentication, ksu_authorization, su_simple, su_authentication, su_successful, wksh_authentication, login_authentication
EVAL-action = if(app="su" AND isnull(action),"success",action)
REPORT-account_management_for_syslog = useradd, userdel
REPORT-firewall = ipfw, ipfw-stealth, ipfw-icmp, pf
REPORT-routing = iptables
EVAL-signature = if(isnotnull(inbound_interface),"firewall",null())
REPORT-signature_for_syslog_timesync = signature_for_nix_timesync

REPORT-dest_for_syslog = host_as_dest
LOOKUP-action_for_syslog = nix_action_lookup vendor_action OUTPUTNEW action
REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src, host_as_src

FROM SPLUNK PRETRAINED

[linux_messages_syslog]
pulldown_type = 1
MAX_TIMESTAMP_LOOKAHEAD = 32
TIME_FORMAT = %b %d %H:%M:%S
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
category = Operating System
description = Format found within the Linux log file /var/log/messages
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!