Getting Data In

Help with syslog tranforms/props

a212830
Champion

Hi,

I've inherited a splunk environment where the syslog needs a fair amount of clean-up. The incoming syslog messages are all types - servers, appliances, routers, switches.... Where possible, I route them using syslog-ng, and then do standard splunk processing. For anything that isn't caught, we route it to an "unknown" index, and I was thinking of adding props/transforms for some of these, so that I don't need to keep adding individual entries in syslog-ng.

Is there a way to add a props/transforms to look for standard cisco ios entries and routing them? The regex is "%[A-Z_]+-[0-9]-[A-Z_]+:".

I'm not sure how to add that to a transforms and route it.

Thanks!

0 Karma

sloshburch
Splunk Employee
Splunk Employee
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Take a look at this answer and see if it gets you started.

You can find applicable documentation here.

0 Karma

a212830
Champion

Thanks. I understand the concept of transforms, just need help with the regex. Can that actual regex be placed in the transforms?

REGEX = %[A-Z_]+-[0-9]-[A-Z_]+:

What happens if it doesn't meet the regex extraction?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yes, the REGEX key is there for you to specify the RegEx you want to apply.
If the RegEx match fails, the original index configured for the sourcetype will take effect. If you don't have an index predefined, the default index will be used. Unless you changed it, that's the main index.

If you are asking about the correct RegEx to identify standard Cisco log events, I'm afraid I can't help you. Maybe you can find some gems in any of the available TAs for Cisco products.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Also, being aware of the lastChanceIndex could end up being strategic for your approach here. See it in http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf. You may find it helps you capture events for which you've yet to define an index or transforms stanza.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...