Getting Data In

splunk event miss data

New Member

splunk event receive syslog ,but it didn'nt appear msg type.
for example
kiwisyslog or 3cdemonalt text

splunk only display "Message"
thank you

Tags (1)
0 Karma

Ultra Champion

That is expected behaviour.

Syslog will only send the "Message" - what you are showing in your screenshot is how your syslog server renders the data for you.

Side Note: I would be a bit alarmed that your syslog server appears to receive the message 14 -17 seconds before the client has sent it!
I'm not familiar with the tool pictured, but it might suggest you have a time sync issue to deal with.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...