Getting Data In

Segregate data from syslog

francois_pigeon
New Member

Hi,
We would like to know how to segregate the content of a syslog in different sources or source types. For example, I already have defined sources A, B & C in Splunk. This new source type comes from syslog and encompasses log data from the same sources: A, B & C but from a different server. The problem is that the log data from the syslog comes in one single stream which is a mix of all three sources. In the data itself we have ways to segregate the sources. For example, each entry starts with an IP and the name of the source: 127.0.0.1 [[sourceName.log]]. Therefore, we would like to know how to automatically segregate the data from the syslog in different sources or source types based on the data coming in. Should we use props.conf to accomplish this?

Thank you,

  • Francois
Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...