Cannot break event by log from syslog

riposans — Fri, 21 Jun 2024 04:02:25 GMT

Dear Everyone

can help me for this, i have log from syslog but cannot break event by lines.

{"@timestamp":"2000-01-21T00:58:39.372418529Z","event":{},"@version":"1","type":"prod","filtered_message":"[ABC]|Type=ABC|logDate=2000-01-21 00:58:39|ABC1=ABC2|ABC12=ABC23|ABC34=ABC35|ABC45=ABC46"}{"@timestamp":"2000-02-21T00:58:39.372418529Z","event":{},"@version":"1","type":"prod","filtered_message":"[ABC]|Type=ABC|logDate=2000-02-21 00:58:39|ABC1=ABC5|ABC13=ABC24|ABC35=ABC36|ABC46=ABC47"}

i need break this log from props.conf, i already used this:

[ABC]

LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false

but not works, please tell me how to extract event log by lines

Re: Cannot break event by log from syslog

tscroggins — Sun, 23 Jun 2024 16:44:39 GMT

Hi @riposans,

The text doesn't appear to be syslog (see RFC 3164 and RFC 5424). Is this a raw TCP or UDP stream? You may want to try:

[ABC] SHOULD_LINEMERGE = false LINE_BREAKER = ()\{"@timestamp" TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%9Q%Z TIME_PREFIX = {"@timestamp":" MAX_TIMESTAMP_LOOKAHEAD = 30 # for events IN THE YEAR 2000 (thanks, Conan!) MAX_DAYS_AGO = 10000

topic Cannot break event by log from syslog in Splunk Enterprise

Cannot break event by log from syslog

Re: Cannot break event by log from syslog