topic Re: How can I break a multiline log by discarding the header and taking the rest? in Getting Data In

How can I break a multiline log by discarding the header and taking the rest?

zcx01067 — Sat, 07 May 2022 20:14:45 GMT

Hello, I have a multiline log file, but each file comes with a header that I want to discard and only use the part of the log that brings the important information, can someone help me.

Here is the original log file:

Audit file /oracle/SIC/AUDIT/SYS_OPERATIONS/ora_1695798.aud
Oracle9i Enterprise Edition Release 9.2.0.8.0 - 64bit Production
With the Partitioning option
JServer Release 9.2.0.8.0 - Production
ORACLE_HOME = /oracle/SIC/920_64
System name: AIX
Node name: duero
Release: 3
Version: 5
Machine: 00CF214F4C00
Instance name: SIC
Redo thread mounted by this instance: 1
Oracle process number: 37
Unix process pid: 1695798, image: oracle@duero (TNS V1-V3)

Sat Mar 19 06:03:53 2022
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

Sat Mar 19 06:03:53 2022
ACTION : '/* BRARCHIVE */ CREATE PFILE = '/oracle/SIC/920_64/dbs/sap.ora' FROM SPFILE = '/oracle/SIC/920_64/dbs/spfileSIC.ora''
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

But I only need these parts of the log:

Sat Mar 19 06:03:53 2022
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

Re: How can I break a multiline log by discarding the header and taking the rest?

gcusello — Sun, 08 May 2022 05:22:41 GMT

Hi @zcx01067,

you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

in few words, add to your props.conf

[your_sourcetype] TRANSFORMS-null = setnull

and to your transforms.conf

[setnull] REGEX = ^Audit\s+file\s+ DEST_KEY = queue FORMAT = nullQueue

Ciao.

Giuseppe

Re: How can I break a multiline log by discarding the header and taking the rest?

PickleRick — Sun, 08 May 2022 13:53:20 GMT

If I understand you correctly, the whole "header thing" is also a multiline "entity".

You could try setting proper event breaking, especially with BREAK_ONLY_BEFORE_DATE. That way you could check later as @gcusello showed and discard anything that - for example - doesn't start with a date.

Re: How can I break a multiline log by discarding the header and taking the rest?

zcx01067 — Mon, 09 May 2022 18:59:42 GMT

Hello @gcusello , I just tried your answer and it is exactly what I needed, thank you very much brother, a big hug from the Dominican Republic.

Re: How can I break a multiline log by discarding the header and taking the rest?

zcx01067 — Mon, 09 May 2022 19:01:47 GMT

Also for you thank you very much brother @PickleRick

Re: How can I break a multiline log by discarding the header and taking the rest?

gcusello — Tue, 10 May 2022 06:07:17 GMT

Hi @zcx01067,

good for you, see next time!

please accept the answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉