Getting Data In

Best way to write syslog to a file on windows?

Jason
Motivator

According to the wiki the best practice for syslog is having another program write the files to disk then have Splunk monitor the files.

What are some good programs you (or your clients) have used to accomplish this?

1 Solution

ftk
Motivator

I have used both Kiwi Syslog Daemon and syslog-win32 with success on Windows.

If you like GUIs use Kiwi. Free version of Kiwi will let you use only a single log file though -- you will have to split by host at index time using props.conf and transforms.conf. Set up Kiwi to log to file in the Kiwi format "ISO yyyy-mm-dd Tab Delimited". Then use the following config stanzas:

inputs.conf:

[monitor://E:\Syslogd\Logs\SyslogCatchAll.txt]
sourcetype = local_syslog
source = syslog
disabled = 0

props.conf:

[local_syslog]
TRANSFORMS-localsyslog=set_local_syslog_hostname
SHOULD_LINEMERGE = false

transforms.conf:

[set_local_syslog_hostname]
DEST_KEY = MetaData:Host
REGEX = \d+\-\d+\-\d+\s+\d+:\d+:\d+\s+[\w\.]+\s+([\w\.]+)\s
FORMAT = host::$1

View solution in original post

ftk
Motivator

I have used both Kiwi Syslog Daemon and syslog-win32 with success on Windows.

If you like GUIs use Kiwi. Free version of Kiwi will let you use only a single log file though -- you will have to split by host at index time using props.conf and transforms.conf. Set up Kiwi to log to file in the Kiwi format "ISO yyyy-mm-dd Tab Delimited". Then use the following config stanzas:

inputs.conf:

[monitor://E:\Syslogd\Logs\SyslogCatchAll.txt]
sourcetype = local_syslog
source = syslog
disabled = 0

props.conf:

[local_syslog]
TRANSFORMS-localsyslog=set_local_syslog_hostname
SHOULD_LINEMERGE = false

transforms.conf:

[set_local_syslog_hostname]
DEST_KEY = MetaData:Host
REGEX = \d+\-\d+\-\d+\s+\d+:\d+:\d+\s+[\w\.]+\s+([\w\.]+)\s
FORMAT = host::$1
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...