Monitor statement for syslog server

[basketballah21]

Trying to figure out the correct monitor statement for my inputs.conf for logs being sent to my syslog server.
/var/log/syslog is where the logs are coming to.
Under /var/log/syslog each remote server has its own directory (some are hostnames, some named IPs) and the logs files are underneath there.

The location of the logs:
/var/log/syslog/server1.net.domain/server1.net.domain.log
/var/log/syslog/server.2.net.fw.domain/server.2.net.fw.domain.log
/var/log/syslog/192.168.45.21/192.168.45.21.log
/var/log/syslog/10.4.5.1/10.4.5.1.log

[whrg · Accepted solution]

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.