topic Re: event breaking not happening in Getting Data In

event breaking not happening

pm2012 — Wed, 22 May 2024 13:38:07 GMT

Hi SMEs, while checking the log from one of the log source i could see logs are not ending properly and getting clubbed all together. Putting the snap below and seeking your best advice to fix it

Re: event breaking not happening

gcusello — Wed, 22 May 2024 13:46:49 GMT

Hi @pm2012,

what's the sourcetype definition for this data flow?

it seems that the LINE_BREAKING isn't configured.

Ciao.

Giuseppe

Re: event breaking not happening

pm2012 — Wed, 22 May 2024 14:18:28 GMT

Hi @gcusello

I am sharing the below config present for this log source

Re: event breaking not happening

gcusello — Wed, 22 May 2024 14:22:16 GMT

Hi @pm2012 ,

the LINE_BREAKING isn't correct.

download a sample of your data in a text file and use it in the guided procedure [Settings > Add data]

in this way, you can find the correct sourcetype definitions to use to parse your data.

Ciao.

Giuseppe

Re: event breaking not happening

pm2012 — Wed, 22 May 2024 16:58:47 GMT

HI @gcusello , I tried it using the way you suggested, it is working while uploading sample log however the same config is not working on live data. Here is the props.conf

[ __auto__learned__ ] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]*){\"event\"\:\{\" NO_BINARY_CHECK=true

Re: event breaking not happening

gcusello — Thu, 23 May 2024 06:39:23 GMT

Hi @pm2012 ,

In the square brackets put the sourcetype you want to add to your data flow.

Put the props.conf file on Search Heads and on the Forwarders they are coming, and (if present) on intermediate Heavy Forwarders.

Ciao.

Giuseppe