topic Why does Splunk sometimes insert the a blank line in forwarded log4net logs? in Getting Data In

Why does Splunk sometimes insert the a blank line in forwarded log4net logs?

rajeevmcaiomedi — Wed, 11 Feb 2015 05:55:26 GMT

I have the following log punch by log4net

DATE   :   02-10-2015 05:06:37
URL    :   http://localhost/229/processType/BY
TYPE   :   ERROR 
DETAILS:
System.Exception: Max TM connection failed, StatusCode:Accepted ,MaxAttempt:21

But by using forwarder i am getting the following log punch on indexer

DATE   :   02-10-2015 05:06:37
URL    :   http://localhost/229/processType/BY
TYPE   :   ERROR 
DETAILS:

System.Exception: Max TM connection failed, StatusCode:Accepted ,MaxAttempt:21

one extra space is included under Details which search does not process for "Max TM connection failed". and no line break i.e ------------
included in the indexer log. This is happening on some events, not all events.

Can you please let me know why this issue arises and what is the workaround for this?

Re: Why does Splunk sometimes insert the a blank line in forwarded log4net logs?

lmyrefelt — Mon, 28 Sep 2020 18:56:49 GMT

Hi,

I would have tried to configure LINE_BREAKER in props.conf for the source type . I have earlier had success with this in similar events / problems. By configure the line_breaker you say to splunk not break your events on standard new-line, break och what ever ... which might be the case.

example
LINE_BREAKER = ([\r\n]+)DATE\s++:\s++\d{2}-\d{2}-\d{4}

LINE_BREAKER = ([\r\n]+)DATE\s++\:\s++\d{2}\-\d{2}\-\d{4}

Re: Why does Splunk sometimes insert the a blank line in forwarded log4net logs?

lmyrefelt — Wed, 11 Feb 2015 19:33:14 GMT

You could open your look file (the source) in some good text-editor like notepad++ and check for line breaks , character returns and other "hidden" stuff , to make sure the source is not appending anything Splunk breaks or splits events on .. i have not seen splunk adding stuff by it selfs