Splunk Search

eqalis - getting cisco_syslog sourcetype

Branden
Builder

I tried out the EQALIS Splunk for Network Operations app. Unfortunately, I don't think I can use it, but maybe someone can help.

The problem is that incoming events from Cisco devices must have a sourcetype of "cisco_syslog". Well, all my syslog events come in to my Splunk server via syslog-ng and are put into a /logs directory which is crawled by monitor. Everything that is crawled in the syslog-ng /logs directory is given a sourcetype of "syslog". That includes servers, switches, etc...

I have to force the sourcetype to be "syslog" in inputs.conf otherwise Splunk will give split the events into sourcetypes I don't want such "auth-too_small", "kern", etc...

Or maybe I'm taking the wrong approach.

I'd like to take advantage of the EQALIS app, but am not sure how to get the cisco_syslog sourcetype assigned to the applicable events when they're crawled by monitor. Does anyone have any suggestions?

Thanks!

0 Karma

eqalisken
Explorer

Hi,

A quick fix would be to use a sourcetype alias in props.conf:

[syslog]
rename = cisco_syslog

Restart Splunk for this to take effect. If you subsequently have problems because the “syslog” sourcetype is gone you can just remove the config and restart to convert back to before.

But if you can identify the Cisco routers from their sub-directory or filenames then you can give these specific ones the “cisco_syslog” sourcetype. Or if not you can give the logs the correct sourcetype per event as explained in below link:

http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Advancedsourcetypeoverrides

Branden
Builder

Thank you for the response.
I don't want to do a sourcetype alias as that would make even non-Cisco products show up as soucetype "cisco_syslog", which would be bad.
The doc you referred me to, however, may be what I'm after. I'm going to look into that. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...