Solved: What is <14> we see in Splunk logs, each log start... - Splunk Community

Splunk Search

<14> prefix is displayed in splunk logs, what does it mean, why is it displayed? Can anyone answer this question please?

1 Solution

Solution

Typically syslog events sent over the network start with a <number> containing information about so called "facility" and severity of the event. See https://datatracker.ietf.org/doc/html/rfc3164#section-4.1.1

View solution in original post

Solution

Typically syslog events sent over the network start with a <number> containing information about so called "facility" and severity of the event. See https://datatracker.ietf.org/doc/html/rfc3164#section-4.1.1

Thank you!

Precisely, which log? Can you provide an example? (Anonymised as necessary.)

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...