I'm getting logs from a dockerized in-house developed application and ingesting them into Splunk. There are 3 types of logs, coming into the log file: 1. Application logs (single line, internal format) 2. UWSGI logs (multiline) 3. ModSecurity serial logging (multiline) The logs are forwarded to remote syslog server, and then ingested into Splunk with universal forwarder. While those logs are in different formats I want to separate them into different indexes for different processing approaches. Is there any good documentation piece/forum post/tutorial/anything that describes effective way to separate different log types from a mixed source? Thank you! ... View more

Hi, I'm collecting syslog events from network to a dedicated universal forwarder using a TCP input on forwarder.  In my Splunk installation I get all the syslog entries, but there's a number in angled brackets (<149>, for example) added to the beginning of every log entry added to Splunk index. That number is not always <149>, it changes, but I cannot find the logic behind those changes. That angled bracketed number does not allow to implement correct field extraction. So my question is: how do I get rid of that number in angled brackets? Shall it be done on forwarder?  I'm sorry if my question is stupid, or is well-covered in documentation, I'm relatively new to Splunk and learning now.   Thank you! ... View more