topic Re: How to break my events? in Getting Data In

How to break my events?

chintan_shah — Fri, 28 Apr 2017 16:21:30 GMT

Hi,
i am trying to break the event which we receive from our hand held devices into separate events but its not working properly.
The logs doesn't have any LINE BREAKER and i am using /msg> as delimiter but its not working.
Can some one help me in breaking this event?

Sample Logs:

Re: How to break my events?

somesoni2 — Fri, 28 Apr 2017 16:39:18 GMT

You're missing sample logs here.

Re: How to break my events?

chintan_shah — Fri, 28 Apr 2017 18:38:28 GMT

Hi
Please find the sample log
PDT Socket Created2214294967295Extracted PDT Request

Re: How to break my events?

chintan_shah — Fri, 28 Apr 2017 18:41:49 GMT

<msg t='status' e='2' d='2017/04/28 14:31:28'><s f='' h='CPDTSocket()'/><i>PDT Socket Created</i><b><z><v n='PDTSocket ID'>221</v></z><z><v n='Socket Handle'>4294967295</v></z></b></msg><msg t='status' e='2' d='2017/04/28 14:31:28'><s f='' h='FetchRequest()'/><i>Extracted PDT Request</i></msg>

Re: How to break my events?

somesoni2 — Fri, 28 Apr 2017 18:50:11 GMT

Try this for your line breaking configuration

[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\/msg\>)*(?=\<msg)
TIME_PREFIX=d='
TIME_FORMAT=%Y/%m/%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=19

Re: How to break my events?

chintan_shah — Fri, 28 Apr 2017 19:20:53 GMT

Thanks @somesoni2.
It worked but the end of the event is looking as < instead of

PDT Socket Created642949672951<

Re: How to break my events?

chintan_shah — Fri, 28 Apr 2017 19:21:06 GMT

<msg t='status' e='2' d='2017/03/30 09:41:05'><s f='' h='CPDTSocket()'/><i>PDT Socket Created</i><b><z><v n='PDTSocket ID'>6</v></z><z><v n='Socket Handle'>4294967295</v></z><z><v n='(logs removed)'>1</v></z></b><

Re: How to break my events?

somesoni2 — Fri, 28 Apr 2017 19:25:54 GMT

It's actually removing string in first brackets in LINE_BREAKER. If you need that you can use below,

[yoursourcetype]
 SHOULD_LINEMERGE=false
 LINE_BREAKER=(\<msg)
 TIME_PREFIX=d='
 TIME_FORMAT=%Y/%m/%d %H:%M:%S
 MAX_TIMESTAMP_LOOKAHEAD=19
 SEDCMD-addheader = s/^(.+)/<msg \1/

Re: How to break my events?

chintan_shah — Fri, 28 Apr 2017 20:25:39 GMT

Thanks Somesoni2. It worked.