topic event cannot break line in Splunk Enterprise

event cannot break line

thangs4 — Mon, 03 Jun 2024 04:44:45 GMT

Hi everyone, I have a problem with the line-break in Splunk. I have tried following the methods as in other posts.
Here is my props.conf
[test1:sec]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=AUTO
disabled=false
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9QZ
TIME_PREFIX=<TimeCreated SystemTime='

when I applied this sourcetype in raw windows, it work. but after I finished, it was one event

raw windows

#line-break

Re: event cannot break line

KendallW — Mon, 03 Jun 2024 05:08:53 GMT

Hi @thangs4 ,

From your second screenshot it doesn't look like the events are being parsed correctly. It looks like there wasn't a clean break between the events, and a timestamp wasn't extracted from the first event.

Try using these settings in props.conf on your indexer/HF to explicitly break events before/after the <Event> and </Event> tags:

KV_MODE=xml TRUNCATE = 0 SHOULD_LINEMERGE = false LINE_BREAKER=([\r\n]+)\<Event\sxmlns TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%9QZ TIME_PREFIX=<TimeCreated SystemTime=' MUST_BREAK_AFTER = \<\/Event\> NO_BINARY_CHECK=true CHARSET=AUTO disabled=false

Re: event cannot break line

thangs4 — Mon, 03 Jun 2024 06:57:18 GMT

Thank you for your reply,

First, let me talk a little bit about my setting. I used regex101 to check the line-break in my config. About the timestamp, it matched with all the events.

I just tried your settings, it did not work. of course, props.conf in /system/local and restart Splunk. Any other ideas, sir?

Re: event cannot break line

KendallW — Tue, 04 Jun 2024 01:06:57 GMT

Here's a couple of things to check:
1. Check the settings you have set in props.conf are actually being applied to the sourcetype:

$SPLUNK_HOME/bin/splunk cmd btool props list test1:sec

2. Check in the _internal logs for errors related to parsing for this sourcetype:

index=_internal splunk_server=* source=*splunkd.log* (component=AggregatorMiningProcessor OR component=LineBreakingProcessor OR component=DateParserVerbose) (log_level=WARN OR log_level=ERROR) data_sourcetype="test1:sec"

Re: event cannot break line

PickleRick — Tue, 04 Jun 2024 07:58:45 GMT

Where did you put your props.conf? (on which component)

And what does your ingest process look like? Because that's apparently not data from a windows eventlog input.