Getting Data In

forwarder logs different type from the indexer.

lifekis
Explorer

I want to use forwarder to forward mail logs to indexer.
However, the log forwarded from the forwarder is displayed separately from the indexer.
how can i solve it.

start character: MAIL_LOG
end character: END_MAIL

[[[forwarder log file]]]
ex1) The forwarder log file looks like this:
MAIL_LOG
date:2019-00-00 00:00:00
subject: abcdefg
from: abc@abc.com
to:abcd@abcd.com
size:12345
content:afafa
...
END_MAIL

[[[indexer]]]
The log is divided.

ex1) only mail start characters logs.
MAIL_LOG

ex2) only part of the message logs.
content:afafa

ex3) Do not include the mail start character logs. MAIL_LOG
date:2019-00-00 00:00:00
subject: abcdefg
from: abc@abc.com
to:abcd@abcd.com
size:12345

0 Karma

gaurav_maniar
Builder

provide the screenshot of the log file and the same data in Splunk.
I think, the issue is because of sourcetype configuration for multiline event.

richgalloway
SplunkTrust
SplunkTrust

Please explain more about what you mean by "the log forwarded from the forwarder is displayed separately from the indexer". Use actual example events, but hide private information.

---
If this reply helps you, Karma would be appreciated.

lifekis
Explorer

The forwarder can check the log file in full format. However, the log is truncated on the indexer.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your props.conf settings probably need to be adjusted. Please provide some sample events and we'll try to help you get the settings right.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...