topic Re: Log4j events line-break not consistent in Getting Data In

Log4j events line-break not consistent

banderson7 — Tue, 29 Sep 2020 09:13:42 GMT

I'm bringing in alfresco logs, in this case share.log and for the most part the events are broken up by line correctly

09:30:32,256 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]      Nothing to push to Solr

, until they're not

09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] 
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Processing 0 orphaned content
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]    Processing Deletes: 0
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]      Nothing to push to Solr
09:30:42,405 INFO  [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco-Solr Sync Alfresco Stats: Total Folders: 737; Total Documents: 44587
09:30:42,405 INFO  [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco-Solr Sync Solr Stats: Already In Solr: 44586; Created: 1; Updated: 0; Removed: 0; Orphaned: 0
09:30:42,413 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco To Solr Push Sync: Job finished

My props is thus:

[XXXXXX:uat:alfresco]
LINE_BREAKER = ([\r\n]+)
#BREAK_ONLY_BEFORE = \d\d?:\d\d:\d\d
pulldown_type = true
maxDist = 75
category = Application

Neither line breaker nor BREAK_ONLY_BEFORE have worked on this correctly. What am I doing wrong? Thanks

Re: Log4j events line-break not consistent

richgalloway — Wed, 30 Mar 2016 14:21:35 GMT

What seems to be the problem? The line breaks look OK to me. Or is the second example a single event?

Re: Log4j events line-break not consistent

banderson7 — Wed, 30 Mar 2016 14:27:07 GMT

The second example shows as one event but it's 7 events in the log.

Re: Log4j events line-break not consistent

woodcock — Wed, 30 Mar 2016 14:46:00 GMT

You need to add this (defaults to true; keep everything else as you showed it:

SHOULD_LINEMERGE=false

Re: Log4j events line-break not consistent

banderson7 — Wed, 30 Mar 2016 14:57:01 GMT

No change, unfortunately.

Re: Log4j events line-break not consistent

woodcock — Wed, 30 Mar 2016 15:15:39 GMT

You have to restart splunk on all the indexers and it will only effect NEWLY INDEXED events.

Re: Log4j events line-break not consistent

banderson7 — Wed, 30 Mar 2016 15:22:26 GMT

So this is not a search time property addition? Ok, thanks.

Re: Log4j events line-break not consistent

woodcock — Wed, 30 Mar 2016 15:30:42 GMT

That is correct.