[HOW TO] Send Logs to Splunk - External Syslog Logging/Dashboards/Reporting

Hey folks!

I noticed when I was trying this out that the messages the driver sends aren't Syslog compatible (RFC5424). In particular not having the facility/priority value at the beginning makes my log server (rsyslog) quite unhappy, with doubled dates, misparsed data, etc.

I have adjusted the logging string to be RFC compatible, which seems to have made rsyslog much, much happier with the data. Additionally, I dropped using structured data mode as not all log servers handle it properly/identically, which makes parsing it harder.

Additionally, the simple "key=value" format is parsed automatically by Splunk:

I've forked the driver at https://raw.githubusercontent.com/rmonk/hubitatSyslogDriver/master/drivers/Syslog.groovy and I'll see if I can get a pull request in to update the original if possible.

1 Like