Monitoring Splunk

Monitor statement for syslog server

basketballah21
Engager

Trying to figure out the correct monitor statement for my inputs.conf for logs being sent to my syslog server.
/var/log/syslog is where the logs are coming to.
Under /var/log/syslog each remote server has its own directory (some are hostnames, some named IPs) and the logs files are underneath there.

The location of the logs:
/var/log/syslog/server1.net.domain/server1.net.domain.log
/var/log/syslog/server.2.net.fw.domain/server.2.net.fw.domain.log
/var/log/syslog/192.168.45.21/192.168.45.21.log
/var/log/syslog/10.4.5.1/10.4.5.1.log

Tags (1)
0 Karma
1 Solution

whrg
Motivator

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

View solution in original post

whrg
Motivator

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...