hi guys,
I've added my first logs in splunk today. I notice that in the beginning of each row splunk has added a prefix of timestamp and host. For example this is a single log line(refer to the bold text):
Jun 29 16:16:44 127.0.0.1 2011-06-29 16:16:44.067 [main ] INFO com.cloudon.VabConnector - About to activate VabConnector with parameters node id [1], ZK_connect_str[127.0.0.1:2181], VabConnectionServerPort[8000], ownIp[10.0.0.8]
I've configured my channel in the web interface in - Home » Add Data » UDP » Add New
I've defined it as syslog source type and I'm sending the logs from my application. I've used wireshark to verify that the message I send is without the prefix.
Do you know why splunk add this prefix?
More importantly, I can I remove it from the logs?
Thanks,
Eldad.
