Splunk Otel Multiline Configs

dgill — Wed, 09 Oct 2024 16:43:25 GMT

I'm using the splunk-otel-collector, and attempting to get multi-line java exceptions into a standardly formatted event. Using the example, my values file contains

multilineConfigs: - namespaceName: value: example useRegexp: true firstEntryRegex: ^[^\s].* combineWith: ""

The rendered configMap contains

- combine_field: attributes.log combine_with: "" id: example is_first_entry: (attributes.log) matches "^[^\\s].*" max_log_size: 1048576 output: clean-up-log-record source_identifier: resource["com.splunk.source"] type: recombine

With that config, the logs continue to split . Then I change the value to

combineWith: "\t"

the following happens with the logs:

Has anyone experienced this and worked around it?

Re: Splunk Otel Multiline Configs

PaulPanther — Fri, 11 Oct 2024 10:50:56 GMT

If you use

combineWith: "\t"

the log entries are correctly splitted or not?

Could you remove the combinedWith parameter from the config and deploy it again?

topic Re: Splunk Otel Multiline Configs in Getting Data In

Splunk Otel Multiline Configs

Re: Splunk Otel Multiline Configs