topic Re: Need to Split the events before parsing into Splunk in Getting Data In

Need to Split the events before parsing into Splunk

anandhalagaras1 — Fri, 22 Mar 2024 08:53:09 GMT

This below mentioned lines are coming as a single event and not as separate events. So we want to get them splitted i.e.. It starts with IP and the end would be with Email field so after which it needs to be a separate next event.

IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 15:10:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/98765_3598/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 17:12:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/1234_9564/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 18:10:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/9821_365/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com IP:aa.bbb.ccc.ddd##Browser:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0##LoginSuccess Wire At:04-03-24 20:10:32##CookieFilePath:/xxx/yyy/abc.com/xyz/abc/forms/submitform/live/12345/222_123/clear.txt##ABC:12344564##Sessionid:xyz-a1-ddd_1##Form:xyz##Type:Live##LoginSuccess:Yes##SessionUserId:123##Email:xyz@google.com

SO kindly let me know how can be get them splitted into separate events.

Re: Need to Split the events before parsing into Splunk

gcusello — Tue, 05 Mar 2024 13:31:01 GMT

Hi @anandhalagaras1,

did you tried SHOULD_LINEMERGE = false?

Ciao.

Giuseppe

Re: Need to Split the events before parsing into Splunk

anandhalagaras1 — Tue, 05 Mar 2024 15:01:37 GMT

@gcusello Yes i have updated the props.conf in the UF of the server. Since I don't have access to the Indexers it didnt worked. Since our Search head are hosted in Cloud and managed by Splunk Support.

So what should i need to do if i need to apply to Indexers directly.

Re: Need to Split the events before parsing into Splunk

gcusello — Tue, 05 Mar 2024 15:14:43 GMT

Hi @anandhalagaras1,

you have to associate SHOULD_LINEMERGE = false to the sourcetype of your data in the UFs and in the Splunk Cloud Search Heads.

Ciao.

Giuseppe

Re: Need to Split the events before parsing into Splunk

kiran_panchavat — Wed, 06 Mar 2024 15:35:25 GMT

@anandhalagaras1 You can apply in the HF's if you have.

Re: Need to Split the events before parsing into Splunk

anandhalagaras1 — Fri, 22 Mar 2024 08:16:31 GMT

@gcuselloAs previously stated, I implemented the setting SHOULD_LINEMERGE = false in Splunk Cloud SH, which successfully resolved the issue. However, the logs contain HTML events, which are now being treated as individual events, resulting in difficulties extracting the desired fields. Could you please advise on how we can address this?

Re: Need to Split the events before parsing into Splunk

jotne — Fri, 22 Mar 2024 09:06:14 GMT

Here are the setting for props.conf

SHOULD_LINEMERGE=false #Should always be false LINE_BREAKER=([\r\n]+)IP #Adds IP to the line breaking (If all lines starts with IP) NO_BINARY_CHECK=true TIME_FORMAT=%e-%m-%y %T #Sets the time format TIME_PREFIX=At: #Use time found after the At: MAX_TIMESTAMP_LOOKAHEAD=20 #Do not search more tha needed for the time

Re: Need to Split the events before parsing into Splunk

isoutamo — Fri, 22 Mar 2024 09:22:41 GMT

here is the new MASA diagram where you could look where to put those and in which server https://splunk-usergroups.slack.com/files/U0483CQG4/F06PKREDNLW/masa.pdf?origin_team=T047WPASC&origin_channel=Psearch

r. Ismo