Getting Data In

Is it possible to selectively line merge syslog-ng truncated events?

JSkier
Communicator

I have a syslog server receiving and filtering into files and then forwarding data to my indexers. One source uses udp, and sometimes a single event gets truncated into typically two lines.

2017-05-24T12:40:19.694287-02:00 server1 blah: [timestamp] ..... [more stu -TRUNCATES-
2017-05-24T12:40:19.694287-02:00 server1 blah: ff this is a continuation of one event] status warn [end]

Is it possible to have Splunk selectively line merge when this happens? For example, most of events are one line and below the message limit, but occasionally these two liner snow flakes come along that need to be merged somehow.

I have looked at the sending appliance and it cannot up the msg size. Also, it can also only send out syslog via UDP so it is bound to the protocol limitation. I haven't seen much for syslog-ng filtering that can address this.

mjeffery_splunk
Splunk Employee
Splunk Employee

Can your network appliance be configured to send syslog over TCP instead?

Also, who makes this network appliance?

0 Karma

JSkier
Communicator

It's a LoadBalancer.org appliance; uses rsyslog to send.

TCP still truncates, the sending from rsyslog does not seem to honor the message size setting of rsyslog.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...