Splunk Search

eqalis - getting cisco_syslog sourcetype

Branden
Builder

I tried out the EQALIS Splunk for Network Operations app. Unfortunately, I don't think I can use it, but maybe someone can help.

The problem is that incoming events from Cisco devices must have a sourcetype of "cisco_syslog". Well, all my syslog events come in to my Splunk server via syslog-ng and are put into a /logs directory which is crawled by monitor. Everything that is crawled in the syslog-ng /logs directory is given a sourcetype of "syslog". That includes servers, switches, etc...

I have to force the sourcetype to be "syslog" in inputs.conf otherwise Splunk will give split the events into sourcetypes I don't want such "auth-too_small", "kern", etc...

Or maybe I'm taking the wrong approach.

I'd like to take advantage of the EQALIS app, but am not sure how to get the cisco_syslog sourcetype assigned to the applicable events when they're crawled by monitor. Does anyone have any suggestions?

Thanks!

0 Karma

eqalisken
Explorer

Hi,

A quick fix would be to use a sourcetype alias in props.conf:

[syslog]
rename = cisco_syslog

Restart Splunk for this to take effect. If you subsequently have problems because the “syslog” sourcetype is gone you can just remove the config and restart to convert back to before.

But if you can identify the Cisco routers from their sub-directory or filenames then you can give these specific ones the “cisco_syslog” sourcetype. Or if not you can give the logs the correct sourcetype per event as explained in below link:

http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Advancedsourcetypeoverrides

Branden
Builder

Thank you for the response.
I don't want to do a sourcetype alias as that would make even non-Cisco products show up as soucetype "cisco_syslog", which would be bad.
The doc you referred me to, however, may be what I'm after. I'm going to look into that. Thanks!

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...