topic Re: line-breaking question... in Getting Data In

line-breaking question...

a212830 — Mon, 14 Apr 2014 00:38:35 GMT

Hi,

I have a new multi-line feed that needs to be put into SPlunk, and it's one of the more challenging ones that I've run into.

The line will start with a number, followed by a colon ":", and then the word Bandwidth, followed by another colon. It could then have variables lines, and it ends with "Name:" and some value. Examples are below. The file also has other info, but I don't want that. Oh yeah, it's on Windows. No idea where to even start on this one (besides, Mad Men and GOT is on tv tonight!).

SubZone:
         1:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "SLC_SZ"
         2:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Canaada_SZ"
         3:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "SLC American Fork_SZ"
         4:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "UK_SZ"
         5:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Japan_SZ"
         6:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Hong Kong_SZ"
         7:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Taiwan_SZ"
         8:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "India_SZ"

Re: line-breaking question...

linu1988 — Mon, 14 Apr 2014 05:05:20 GMT

Hello,
You can use props.conf to manage that in indexer end.

BREAK_ONLY_BEFORE=\d:

will make sure the events break at only with a number and colon.

Thanks

Re: line-breaking question...

a212830 — Mon, 14 Apr 2014 19:33:33 GMT

Thanks. I got that working. Any suggestion on filtering out (or filtering in) in this type of situation? The event should start with a number, followed by a colon, and end with "Name:" and some value. Anything that doesn't meet that criteria should be filtered.

Re: line-breaking question...

linu1988 — Mon, 14 Apr 2014 19:38:14 GMT

Best option always will be setting the start or end. I see start is the better way. There is not much pattern to redirect the inputs to null queue. So better leave it that way. it will be very hard to filter lines inbetween your multi line event. If it solves the issue mark it as an answer...

Re: line-breaking question...

a212830 — Tue, 15 Apr 2014 00:03:49 GMT

Thanks. I'm also going to look at the SEDCMD, which allows me to run sed commands against the stream.