Mailing-List: contact dev-help@nifi.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@nifi.apache.org
MIME-Version: 1.0
In-Reply-To: <CAM7UEYT9VjAdBkjNgWPoUGO03F4cLaNMO+k1_HLE4_kMJTMQow@mail.gmail.com>
References: <151765029.322421.1508412701943.ref@mail.yahoo.com>
 <151765029.322421.1508412701943@mail.yahoo.com> <CAM7UEYT9VjAdBkjNgWPoUGO03F4cLaNMO+k1_HLE4_kMJTMQow@mail.gmail.com>
From: Bryan Bende <bbende@gmail.com>
Date: Thu, 19 Oct 2017 09:36:56 -0400
Message-ID: <CALo_M18vgH2iHHntqNe_Nf05YTMwCe3xrMjSszTfbqKn4Hpq1A@mail.gmail.com>
Subject: Re: Syslog processing from cisco switches to Splunk
To: dev@nifi.apache.org
Content-Type: text/plain; charset="UTF-8"
archived-at: Thu, 19 Oct 2017 13:37:02 -0000

If you can provide an example message we can try to see why
ListenSyslog says it is invalid.

I'm not sure that will solve the issue, but would give you something
else to try.

On Thu, Oct 19, 2017 at 8:38 AM, Andrew Psaltis
<psaltis.andrew@gmail.com> wrote:
> Dave,
> To clarify you are using the PutUDP processor, not the PutSplunk processor?
>
> On Thu, Oct 19, 2017 at 7:31 AM, DAVID SMITH <davidrsmith@btinternet.com>
> wrote:
>
>> Hi
>> We are trying to do something which on the face of it seems fairly simple
>> but will not work.We have a cisco switch which is producing syslogs,
>> normally we use zoneranger to send them to Splunk and the records are
>> shown.However we want to do a bit of content routing, so we are using NiFi
>> 0.7.3 with a ListenUDP on port 514 and we can see the records coming in to
>> NiFi. Without doing anything to the records we use a putUDP to send records
>> to the Splunk server, NiFi says they have sent successfully but they never
>> show in Splunk.We have used a listenUDP on another NiFi and the records
>> transfer and look exactly the same as they were sent.We have also used
>> listenSyslog and putSyslog, but the listenSyslog says the records are
>> invalid.
>> Has anyone ever to do this, and can you give us any guidance on what we
>> may be missing?
>> Many thanksDave
>
>
>
>
> --
> Thanks,
> Andrew