How to combine two consecutive lines into a single event using the upload file option in "Add Data"?

jeck11 — Thu, 23 Feb 2017 16:22:01 GMT

I have been searching through the thousands of results I've gotten on this topic but they all seem to be more advanced than what I'm looking for.

Here is an example from the data:

2017-02-22T18:00:54 <HOST>            | Creating request for https://0.0.20.20/ (www.company.com) Company VIP Site 2
2017-02-22T18:00:54 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 VIP; URL: https://0.0.20.20/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.30/ (www.company.com) Company VIP Site 1
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 1; URL: https://0.0.20.30/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.40/ (www.company.ca) Company VIP Site 2 CA
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 CA VIP; URL: https://0.0.20.40/; Domain: www.company.ca; Expiration: 08/10/2018 08:00:00
2017-02-22T18:01:02 <HOST>            | Creating request for https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/ (smetrics.company.com) Omniture Metrics US VIP
2017-02-22T18:01:02 <WARNING>         | Error SSL1406 - A certificate was not evaluated for the web request.; Data: Omniture Metrics US VIP; URL: https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/; Domain: smetrics.company.com
2017-02-22T18:01:06 <HOST>            | Creating request for https://0.0.20.50:8080/ (sec-comp-axm) RSA Access Manager Site 2 VIP
2017-02-22T18:01:06 <ERROR>           | Error SSL1404 - The SSL policy returned an error.; Data: RemoteCertificateNameMismatch RSA Access Manager Site 2 VIP; URL: https://0.0.20.50:8080/; Domain: sec-comp-axm; Expiration: 09/29/2018 15:46:00

I'm trying to use the "Add Data" option to upload the file. I need each entry that's broken out to contain two rows. The first is the target and the second would be the result. It doesn't seem like this should be that hard... what am I missing?

Re: How to combine two consecutive lines into a single event using the upload file option in "Add Data"?

dwaddle — Thu, 23 Feb 2017 19:11:46 GMT

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8

topic How to combine two consecutive lines into a single event using the upload file option in "Add Data"? in Getting Data In

How to combine two consecutive lines into a single event using the upload file option in "Add Data"?

Re: How to combine two consecutive lines into a single event using the upload file option in "Add Data"?