topic props in Getting Data In

props

abhi04 — Mon, 05 Feb 2024 21:40:39 GMT

Hi I am trying to divide the the logs into different evwnt based on below scenario:

I have one single event currently:

Issuer : hjlhjk

a: xyz

PrivateKey : abc

Issuer : dfjh

a: fhfh

PrivateKey : dsgd

Now I want it as two events:

event1:

Issuer : hjlhjk

a: xyz

PrivateKey : abc

event2:

Issuer : dfjh

a: fhfh

PrivateKey : dsgd

how can i get this?

I tried below line breaking which is not working

[sourcetype]
LINE_BREAKER = ([\r\n]+)(PrivateKey)

[sourcetype]
BREAK_ONLY_BEFORE = Issuer
SHOULD_LINEMERGE = false

Re: props

abhi04 — Mon, 05 Feb 2024 22:36:06 GMT

These logs are collected using scripted input using .bat file it has several lines in one events , I only showed 6 lines per event but the repetion is same with more lines in between privatekey and issuer

Re: props

scelikok — Mon, 05 Feb 2024 23:43:04 GMT

Hi @abhi04 ,

Can you please try below?

[sourcetype] LINE_BREAKER = PrivateKey\s+:\s+\w+([\r\n]+) SHOULD_LINEMERGE = false

Re: props

abhi04 — Tue, 06 Feb 2024 13:58:08 GMT

Hi @scelikok I missed mentioning that Private key can be one of the below format:

format 1:

PrivateKey : abc.def.ghi.jkl

format 2:

PrivateKey :

Meaning it can be empty as well as in format 1