Event Breaking Incorrectly

whunterj — Mon, 21 Oct 2024 23:29:33 GMT

I am setting up a monitor on the log file for my Dolphin Gamecube emulator. Dolphin and Splunk Enterprise are both running locally on my machine (Windows 11). Splunk is ingesting multiple lines per event, and my hope is to get each line to ingest as a separate event. I have tried all kinds of different props.conf configurations including SHOULD_LINEMERGE, LINE_BREAKER, BREAK_ONLY_BEFORE, etc. I'll paste a sample of the log file below. In this example, Splunk is ingesting lines 1 & 2 as an event, and then 3 & 4 as an event. When I turn on more verbose logging, it will lump even more lines into an event, sometimes 10+

21:23:310 Common\FileUtil.cpp:796 I[COMMON]: CreateSysDirectoryPath: Setting to C:\Users\whjar\mnt\file-system\opt\dolphin\dolphin-2409-x64\Dolphin-x64/Sys/

21:23:323 DolphinQt\Translation.cpp:155 W[COMMON]: Error reading MO file 'C:\Users\whjar\mnt\file-system\opt\dolphin\dolphin-2409-x64\Dolphin-x64/Languages/en_US.mo'

21:24:906 UICommon\AutoUpdate.cpp:212 I[COMMON]: Auto-update JSON response: {"status": "up-to-date"}

21:24:906 UICommon\AutoUpdate.cpp:227 I[COMMON]: Auto-update status: we are up to date.

Re: Event Breaking Incorrectly

richgalloway — Tue, 22 Oct 2024 00:03:09 GMT

Try these props.conf settings.

[dolphin] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d\d:\d\d:\d\d\d DATETIME_CONFIG = current

Re: Event Breaking Incorrectly

whunterj — Tue, 22 Oct 2024 02:26:02 GMT

This worked! Much appreciated, thank you.

topic Event Breaking Incorrectly in Getting Data In

Event Breaking Incorrectly

Re: Event Breaking Incorrectly

Re: Event Breaking Incorrectly