Extracting multiline events into single line kv pairs.

JordanPeterson — Thu, 10 May 2018 21:59:56 GMT

So I have a script that we use to monitor our time drift on servers. The events look like this when ran:

server 10.0.1.187, stratum 4, offset 0.031839, delay 0.04155
server 10.0.1.188, stratum 5, offset -0.000584, delay 0.04158

How should I configure my props.conf and transforms.conf so I have nice clean field extraction?

So essentially each event is this but you may get 2-3 events per run of the script:

key value, key value, key value, key value

Update: I decided I was okay with search time extraction based on reading the props.conf documentation recommending this and so I have the following search:

basesearch | rex field=_raw "server (?<server>.*), stratum (?<stratum>.*), offset (?<offset>.*), delay (?<delay>.*)"

Which is fine if I only have one event but for multiline events it ignores all events after the first. How should I change this regex?

Re: Extracting multiline events into single line kv pairs.

xpac — Thu, 10 May 2018 22:14:03 GMT

Hey,

this regex should match those kind of events pretty well:
\s?([^\s,]+)\s([^\s,]+)(?:,|$)
regex101.com link

You could then create a stanza in props.conf for your sourcetype/host/source to match, and have it include:
REPORT-ntpevents = ntpevents

Then have transforms.conf like

[ntpevents]
REGEX = \s?([^\s,]+)\s([^\s,]+)(?:,|$)
MV_ADD = true
FORMAT = $1::$2

Hope that helps!

topic Extracting multiline events into single line kv pairs. in Splunk Enterprise

Extracting multiline events into single line kv pairs.

Re: Extracting multiline events into single line kv pairs.