topic Re: props.conf event breaks in Getting Data In

props.conf event breaks

aaronkorn — Mon, 28 Sep 2020 14:22:13 GMT

Hello,

We have the following format of a log starting with the first message in the log as Status_AdvCorrServerSerial = 0 then the last line of the event as RawCaptureTimeStamp = #, which we set at the timestamp. After the event in the format below there are 2 spaces between each event then it goes into the same format again.

Status_AdvCorrServerSerial = 0
50 Some lines of material...
RawCaptureTimeStamp = 1373987459
-new line-
-new line-
Status_AdvCorrServerSerial = 0
50 Some lines of material...
RawCaptureTimeStamp = 1373987459

Here is our props.conf but it does not seem to properly break on all events:

[ncpmonitor]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial =
TIME_PREFIX=RawCaptureTimeStamp =

Is there something additional I should add to account for the 2 spaces between events or does this props.conf entry look alright?

Thanks!

Re: props.conf event breaks

lguinn2 — Wed, 17 Jul 2013 18:52:20 GMT

I would probably change the regexes a bit so that they are more flexible regarding the spacing:

[ncpmonitor]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial\s*=
TIME_PREFIX=RawCaptureTimeStamp\s*=\s*

Where exactly are the "spaces"? Are you talking about 2 blank lines between events or two spaces that sometimes appear at the beginning of the line with Status_AdvCorrServerSerial? Splunk should only break events at a line break when you are using BREAK_ONLY_BEFORE - it should break at the beginning of the line that matches.

Re: props.conf event breaks

aaronkorn — Wed, 17 Jul 2013 19:39:23 GMT

Thanks for your post. The two spaces are between events. Ill give this a shot

Re: props.conf event breaks

sdaniels — Wed, 17 Jul 2013 20:04:15 GMT

Beat me to it. One other thing is you may need to specify TIME_FORMAT=%s for the epoch time stamp recognition.

Re: props.conf event breaks

lguinn2 — Wed, 17 Jul 2013 21:20:52 GMT

You could also try

BREAK_ONLY_BEFORE=\s*Status_AdvCorrServerSerial\s*

It shouldn't make a difference, though.