Windows event log Splunk HF with truncation

[sarvananth]

We are using Splunk Universal Forwarder (UF) to forward logs from a Windows server to a Splunk Heavy Forwarder (HF). However, when the Splunk HF receives logs of a specific type as multiline, an issue arises. In this case, when attempting to forward these logs from the Splunk HF to a syslog server (a Linux server with rsyslog configuration), the logs are getting truncated. How can we address and resolve this issue?

[tscroggins]

Hi @sarvananth,

Have you reviewed rsyslog documentation for maximum message length and line endings? If you're forwarding using a syslog output over UDP, the transport itself has a limit of 65,535 bytes per datagram (subtract headers for maximum payload length). You may also want to transform the events by replacing line endings with an escape sequence of your choosing (or one required by the consumer).

[richgalloway]

The screenshot shows an untruncated event.  What makes you believe the logs are getting truncated?  Please show a sanitized sample truncated event.

Why are the events going from a Splunk HF to a syslog server instead of to a Splunk indexer?

[sarvananth]

please check the truncated event from syslog server 

We are attempting to send logs to both the Splunk indexer and the syslog server because different teams handle distinct log types. My team manages the system security logs specifically for SOC team monitoring.

[JunYamaguchi]

This can be caused by syslog not supporting newlines(\n).
The following settings on the HF will improve this.

props.conf

[your-sourcetype]
TRANSFORMS-◯◯ = transname

transforms.conf

[transname]

INGEST_EVAL = _raw=replace(_raw, "\n", " ")