topic Re: How do I line break this data source? in Getting Data In

How do I line break this data source?

BlakeDC — Fri, 13 May 2016 23:19:48 GMT

ComputerTarget=EDITED; NeededCount=31; DownloadedCount=0; NotApplicableCount=82225; NotInstalledCount=31; InstalledCount=32; FailedCount=0
ComputerTarget=EDITED; NeededCount=202; DownloadedCount=0; NotApplicableCount=81555; NotInstalledCount=202; InstalledCount=154; FailedCount=0
ComputerTarget=EDITED; NeededCount=203; DownloadedCount=0; NotApplicableCount=81921; NotInstalledCount=203; InstalledCount=156; FailedCount=0

This is my data source. I have it setup in props.conf to linebreak after FailedCount=####### but it doesn't seem to be working (data never reaches Splunk unless I remove the props settings).

Here's my props:

[NeededCount]
CHARSET = UTF-16LE
is_valid = True
SHOULD_LINEMERGE = True
MUST_BREAK_AFTER = (FailedCount=\d{1,10})

I need help in making sure it'll break after that failedcount=#### so that each line shows up in Splunk as its own event and not just a giant event of 130+ lines.

Re: How do I line break this data source?

ltawfall — Fri, 13 May 2016 23:52:45 GMT

Does the file have newlines?

LINE_BREAKER=([\r\n]+)
SHOULD_LINEMERGE = false

generally works.

Re: How do I line break this data source?

BlakeDC — Sat, 14 May 2016 01:01:31 GMT

It's a powershell output to a file. It's basically all the lines at once.

I've tried to default which you pasted above but when I do that no data is showing up in splunk 😞

Re: How do I line break this data source?

BlakeDC — Sat, 14 May 2016 01:21:29 GMT

I added a "`n" to the end of the output file so each line now has a hard break inserted. It shows up now but it's still just one single event instead of an event for each line 😞

It basically thinks I have 300 fields in this log and I can't parse!

Re: How do I line break this data source?

mosman_splunk — Tue, 29 Sep 2020 09:41:48 GMT

LINE_BREAKER=(FailedCount=\d+)\s+ComputerTarget
SHOULD_LINEMERGE = false

Good luck

Re: How do I line break this data source?

ltawfall — Mon, 16 May 2016 18:38:18 GMT

bah.. I need to actual output file to to get this correctly. I've had to do a lot of weird line parsing lately, so it's fresh in the brain.