topic how to split a log file which contain multiple KPI information as many individual events using the delimiter "==========="? in Getting Data In

how to split a log file which contain multiple KPI information as many individual events using the delimiter "==========="?

senthamilselvan — Tue, 29 Sep 2020 15:50:21 GMT

[Pra] KPI_DB_001: Transactions per sec

Detailed breakdown of processing time % Total

***********************************************
Total processing 100 14566023932

Section execution

TOTAL_SECTION_PROC_TIME 3 575697340

TOTAL_SECTION_SORT_PROC_TIME 0 3809

[Pra] KPI_DB_005 Buffer pool hit ratio.

Type Ratio Formula

Data 9 (1-(16829502+6813417-15031035)/(3417808829+576
Index 99 (1-(4308509+1968-191493)/(6726500833+356522))

================================================================================

[Pra] KPI_DB_007

Per activity                    Total                                      (micro sec or nano sec ?)

LOCK_WAIT_TIME 0 2131581

LOCK_WAITS 0 547

================================================================================

[Pra] KPI_DB_006

Row processing
ROWS_READ/ROWS_RETURNED = 3325 (292223944055/87871120)

================================================================================

i want each kpi as individual event while importing my log file, please help me 🙂

Re: how to split a log file which contain multiple KPI information as many individual events using the delimiter "==========="?

gcusello — Thu, 21 Sep 2017 15:09:56 GMT

HI senthamilselvanj,
did you tried to insert in your props.conf something like the following configuration?

[ your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\[Pra\]\s+KPI

Bye.
Giuseppe

Re: how to split a log file which contain multiple KPI information as many individual events using the delimiter "==========="?

senthamilselvan — Tue, 29 Sep 2020 15:50:29 GMT

Hi Giuseppe,

Thank you for the replay, I tried but the syntax is not working as expected. Please find the below detailed info.
The below is my sample log files. All the information will come as single log file and i want to breaks this as separate events based on the delimiter "=====" . which is coming along with the log file.

Monitoring report - database summary

Database: DQA01CDW

Generated: 08/16/2017 11:03:38

Interval monitored: 900

Transactions per sec
ACT_COMPLETED_TOTAL 2760Pra 2484587[Pra] TPS cumulative value for last 900 sec

Component times

-- Detailed breakdown of processing time --

                                  %                 Total                     
                                  ----------------  --------------------------

Total processing 100 14566023932

Buffer pool hit ratio. This KPI is captured based on type, we can include Data, Index, XDA, COL. Formula is nice to have
Buffer pool

Buffer pool hit ratios

Type Ratio Formula

Data 9Pra (1-(16829502+6813417-15031035)/(3417808829+576

I tried using the below props.config file to split the logs
[dbmonitoring]
BREAK_ONLY_BEFORE = [=]+
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
category = Application
pulldown_type = true

But still events are not separated as expected based on delimiter.

Thanks
selvan