Getting Data In

Is there a document about making a Syslog message stream "Splunk-friendly"?

CharlesM2
Engager

I am responsible for an "agent" that sends Syslog messages to a variety of SIEMs and similar software. I have based on trial-and-error introduced some options that seem to make it more "Splunk-friendly." Is there a document that would help with this effort?

0 Karma
1 Solution

lguinn2
Legend

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!

View solution in original post

CharlesM2
Engager

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

0 Karma

CharlesM2
Engager

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes.

0 Karma

CharlesM2
Engager

Great stuff! Thanks! I am doing all of the stuff in the early paragraphs of "Logging Best Practices." I am not using commas but I could trivially -- do commas really help? (I am just using spaces.) Everything is

keyword
label=value
label="value with embedded blanks"

separated by spaces.

What about embedded quotation marks in quoted strings? What is the standard?

label="As the saying goes, \"a stitch in time saves nine\""
label="As the saying goes, ""a stitch in time saves nine"""
label='As the saying goes, "a stitch in time saves nine"'

For Syslog data that is standard RFC 3164: mmm dd hh:mm:ss hostname and then the tag=value formats above, what should be the pretrained source type?

Thanks again. Don't see a "mark as answer" button.

0 Karma

yannK
Splunk Employee
Splunk Employee

for quoted strings ,the standard should be

label="As the saying goes, \"a stitch in time saves nine"
OR

label='As the saying goes, "a stitch in time saves nine"'

lguinn2
Legend

To "mark as answered" just click the check-mark outline.

0 Karma

lguinn2
Legend

Splunk knows a lot of syslog-type formats; some of them it recognizes automatically. For others, you can specify the sourcetype that Splunk should use. In the documentation links, I think you will find a syslog format that matches what you have without a lot of work on your part.

List of pretrained sourcetypes

Why sourcetypes matter

If you really have the ability and desire to create/use a new format, you can look at this

Logging best practices

That's pretty cool, but most people don't have that kind of control over the output format. And Splunk works perfectly well with many standard formats. I'm just sorry that you had to do the trial-and-error approach first!

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...