topic Re: How do I configure line breaking for this text file? in Getting Data In

How do I configure line breaking for this text file?

DavidHourani — Tue, 29 Sep 2020 08:47:31 GMT

Hello Splunkers,

I'm having an issue with my event break. I have a huge text file with no line breaks that looks something like:

2016-02-08T12:25:21+01:00blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla 2016-02-08T12:25:21+01:00taablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla2016-02-08T12:25:21+01:00blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla2016-02-08T12:25:21+01:00blablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla

I tried using the BREAK_ONLY_BEFORE setting and other settings to break my event, but nothing works. Any ideas how I can break this?

Regards,
David

Re: How do I configure line breaking for this text file?

skoelpin — Thu, 11 Feb 2016 12:34:59 GMT

Try this.. Make sure you put this stanza in your props.conf on the indexer and restart your Splunk service after adding this

[SOURCE]
 SHOULD_LINEMERGE=true
 BREAK_ONLY_BEFORE = \d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\+\d{2}

Re: How do I configure line breaking for this text file?

DavidHourani — Thu, 11 Feb 2016 12:54:15 GMT

I did, it doesn't work. im using GUI for import and events aren't getting split no matter what i do.

Re: How do I configure line breaking for this text file?

skoelpin — Thu, 11 Feb 2016 14:29:04 GMT

Is there a space between the text and the timestamp in your logs?

Re: How do I configure line breaking for this text file?

DavidHourani — Thu, 11 Feb 2016 14:36:34 GMT

yeap whitespace right before the timestamps..its all in one huge block.

Re: How do I configure line breaking for this text file?

skoelpin — Thu, 11 Feb 2016 14:57:06 GMT

I'm confused. There appears to be a space before some of the timestamps but in others there is no space before the timestamp, regex wouldn't pick this up as it doesn't fit a pattern.

This should work and if not, then I would suggest modifying your log files so it includes a space

BREAK_ONLY_BEFORE = \d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\+\d{2}\:\d{2}