The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkGeneral: Really Basic Syslog Facilities Question

Previous Topic: Issues with external lookup fields from static file  |   Next Topic: JSON Formatted Logs


Posts 1–3 of 3
1
posted by: jmarcus  |  posts
date: March 10, 2010
permalink

Hi,
This is something I have never been really clear on. Is SYSLOG local7 on a Cisco device an accumulation of the messages in local0-6?

Thanks,
James

2
posted by: araitz  |  posts
date: March 10, 2010
permalink

I think you mean priority rather than facility. Yes, in most cases, local7 (aka debug) will encapsulate 0-6.

3
posted by: jmarcus  |  posts
date: March 11, 2010
permalink

Hi Araitz,
Thanks for the reply.

James