Application: Syslog Priority Decoder

Categories:

Description

this searchscript converts syslog priority into the appropriate severity and facility.

  • Download the script into $SPLUNK_HOME/etc/searchscripts
  • Make sure the script has the right permissions and owner
  • If using the enterprise version make appropriate changes to authorize.conf and commands.conf (making sure to turn off headers: enableheader = false)

example commands.conf:

[syslogpri]
filename = syslogpri.py
enableheader = false

example authorize.conf:

[capability::run_script_syslogpri]

[role_Admin]
run_script_syslogpri = enabled

  • pipe search results to syslogpri:

sourcetype=syslog | syslogpri

Rating

(1 vote)
Login to rate this Application

Preview Application: