Monitoring Splunk

Monitor statement for syslog server

basketballah21
Engager

Trying to figure out the correct monitor statement for my inputs.conf for logs being sent to my syslog server.
/var/log/syslog is where the logs are coming to.
Under /var/log/syslog each remote server has its own directory (some are hostnames, some named IPs) and the logs files are underneath there.

The location of the logs:
/var/log/syslog/server1.net.domain/server1.net.domain.log
/var/log/syslog/server.2.net.fw.domain/server.2.net.fw.domain.log
/var/log/syslog/192.168.45.21/192.168.45.21.log
/var/log/syslog/10.4.5.1/10.4.5.1.log

Tags (1)
0 Karma
1 Solution

whrg
Motivator

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

View solution in original post

whrg
Motivator

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!