Getting Data In

Why when applying Props.conf, HF suddenly stops?

ivan5593
Engager

Hello all,

We are using an RSyslog to write logs to file in a Heavy Forwarder but we found that it was escaping tabs as #011. We found a solution that is apply to the file source a SEDCMD as follows:

inputs.conf

 

[monitor:///opt/splunk-data/<datafile>]
sourcetype=<datasource>

 

 props.conf

 

[source::///opt/splunk-data/<datafile>]
SEDCMD-fix_tab = s/#011/	/g

 

 

We applied the configuration and restarted the HF and worked by about 15 minutes but then suddenly stopped to change this character by a tab. Why can this happen?

Thank you!

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

what you are meaning with "suddenly stopped to change this character by a tab" ? Are those come again as #011 or what?

Have you several HFs which are collecting those events and send those to splunk? Or several places where you are collecting those from one HF?

Is there any way that you can change rsyslog's option EscapeControlCharactersOnReceive off to avoid that coding on rsyslog side?

There are also other escape character what it's converting and also you should remember that 8 times space is not exactly the same than <tab>!

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...