topic How to configure line breaker? in Getting Data In

How to configure line breaker?

sgarcia — Wed, 15 Feb 2023 20:59:58 GMT

Hola comunidad

I'm trying to configure the props file so that the following event starts from the third line:

Currently, I am testing as follows:

If I leave this setting, the timestamp of the first few lines will be taken from splunk, but it should take the timestamp of the lines with date.

Regards

Re: How to configure line breaker?

gcusello — Thu, 16 Feb 2023 07:45:49 GMT

Hi @sgarcia,

you have to filter the first three rows using something l.ike this:

in props.conf:

[yoursourceytpe] SHOULD_LINEMERGE = false TRANSFORMS-removeheaderevent = setnull

in transforms.conf:

[setnull] REGEX = ^(REPORTESDEBIT|TotalMovimientos|Id;Usuario) DEST_KEY = queue FORMAT = nullQueue

Please, next time, put the log samples in the Code/Sample box instead using a printscreen so we can use it to answer.

Ciao.

Giuseppe

Re: How to configure line breaker?

sgarcia — Fri, 17 Feb 2023 14:05:10 GMT

Thank you, i try the configuration, and comeback as soon .

Re: How to configure line breaker?

sgarcia — Fri, 17 Feb 2023 14:05:51 GMT

REPORTESDEBITACORAGRAL;;;;;;;;;;
TotalMovimientos:;;;;;;;;;;
ID;Usuario;Fecha/Horadecaptura;Tipodeoperacion;Clave;Emisor;Receptor;MediodeEntrega;Importe;Estado;TipodeError
1675816017182;DKXMMHA;07/Feb/202318:26hrs.;Logout;FinSesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675815710949;DKXMMHA;07/Feb/202318:21hrs.;Login;Ini.SesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814586855;SPEI;07/Feb/202318:03hrs.;AvisoTraspasoOK;2035;Sindefinicion;Sindefinicion;Sindefinicion;30,430,522.05;OK;
1675814481168;SPEI;07/Feb/202318:01hrs.;Act.delCat.Ins.;EnsesionInstituciones.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814481200;SPEI;07/Feb/202318:01hrs.;Act.delCat.Cert.;EnsesionCertificados.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814481231;SPEI;07/Feb/202318:01hrs.;Act.delCat.Nvls.;EnsesionNiveles.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;

Re: How to configure line breaker?

gcusello — Fri, 17 Feb 2023 16:21:37 GMT

Hi @sgarcia,

please try this regex:

^(REPORTESDEBITACORAGRAL|TotalMovimientos|ID;Usuario)

that you can test at https://regex101.com/r/0m8hng/1

Ciao.

Giuseppe