Monitoring Splunk

Monitor statement for syslog server

basketballah21
Engager

Trying to figure out the correct monitor statement for my inputs.conf for logs being sent to my syslog server.
/var/log/syslog is where the logs are coming to.
Under /var/log/syslog each remote server has its own directory (some are hostnames, some named IPs) and the logs files are underneath there.

The location of the logs:
/var/log/syslog/server1.net.domain/server1.net.domain.log
/var/log/syslog/server.2.net.fw.domain/server.2.net.fw.domain.log
/var/log/syslog/192.168.45.21/192.168.45.21.log
/var/log/syslog/10.4.5.1/10.4.5.1.log

Tags (1)
0 Karma
1 Solution

whrg
Motivator

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

View solution in original post

whrg
Motivator

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...