Getting Data In
Highlighted

syslog parsing...

Champion

Hi,

I need to process a syslog feed, but only keep certain hosts, and throw the rest away.

I first setup the feed to process syslog and set the host to the incoming device, and everything looks ok.

However, once I add the piece to parse the syslog, the naming of the host reverts back to the name of the server where the forwarder is running (running a heavy forwarder). I'm not sure why that is happening. Here are my props.conf and transforms.conf:

props.conf:
[eucsyslogdata]
MAX
TIMESTAMPLOOKAHEAD = 32
SHOULD
LINEMERGE = False
TIMEFORMAT = %b %d %H:%M:%S
NO
BINARY_CHECK = 1
TRANSFORMs = syslog-host,setnull,setparsing

transforms.conf:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = [vc-]
DEST_KEY = queue
FORMAT = indexQueue

[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(\w[\w.-]{2,})]?\s
FORMAT = host::$1

Tags (1)
0 Karma
Highlighted

Re: syslog parsing...

Splunk Employee
Splunk Employee

I see a typo :

TRANSFORMs = syslog-host,setnull,setparsing

should be

TRANSFORMS = syslog-host,setnull,setparsing

0 Karma