Simple method to truncate Cisco ISE syslogs to 2000 characters to reduce Splunk database size

[anthonyi]

Hello.

I cannot find an answer to this simple question, although I have found other information utilizing props.conf and transforms in more complicated situations.

I currently have a single Splunk instance as an all-in-one solution, and I am looking for a simple method to truncate ISE logs to 2000 characters to lower Splunk database size. ISE itself is not capable of this.

I am very familiar with Splunk via GUI, but not at all with modifying the configuration files, so step by step instructions would be very helpful.

Thanks in advance.

[kiran_panchavat · Accepted solution]

@anthonyi 

Identify the sourcetype of your Cisco ISE logs. Common sourcetypes for ISE are cisco:ise:syslog.. You can

confirm this in Splunk’s GUI or CLI.

GUI: 

• Go to Search & Reporting.
• Run a search like index=<indexname>
• Check the sourcetype field in the events to note the exact name (e.g., cisco:ise:syslog).

CLI:

The sourcetype for Cisco ISE can be identified in the inputs.conf file through the CLI.

Edit props.conf to Truncate Events, You can find out the props.conf details using the below command:

/opt/splunk/bin/splunk btool props list --debug 

For instance, if you have the props.conf file located in /opt/splunk/etc/system/local, you can configure it with the following settings:

vi /opt/splunk/etc/system/local/props.conf 

Add the following stanza to set the TRUNCATE parameter for your ISE logs:

[your_sourcetype]
TRUNCATE = 2000

For example, if your ISE logs have a sourcetype of cisco:ise:syslog, the stanza would be:

[cisco:ise:syslog]
TRUNCATE = 2000

This setting ensures that any event exceeding 2000 bytes will be truncated, effectively reducing the size of each event stored in Splunk.

After saving the changes to props.conf, restart your Splunk instance to apply the new configuration.

/opt/splunk/bin/splunk restart

NOTE: 

If this add-on is not yet installed, please proceed with the installation. it https://splunkbase.splunk.com/app/1915 

Reference for sourcetypes:

https://splunk.github.io/splunk-add-on-for-cisco-identity-services/Sourcetypes/ 

[livehybrid]

Hi @anthonyi

Are you using an on-premise or Splunk Cloud environment?

If you're using Splunk Cloud: 

In the Splunk UI, go to Settings -> sourcetypes.

Find/click the sourcetype you want to restrict the length of, then click the "Advanced" tab.

If there is already a "TRUNCATE" value then update this to 2000 and hit save.

If there isnt then click "New Setting" at the bottom and then enter TRUNCATE for the name and 2000 for the value.

If you are running on-premise then its unlikely you'll be able to make the changes in this way unless you are using a all-in-one instance, which generally wouldnt be used for production.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[anthonyi]

Thanks. On prem. All-in-one.

[livehybrid]

Great, in that case you should be able to make the changes in the UI if preferred.

Did this work for you?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing