topic Re: Line breaking not working with rolling log files in Getting Data In

Line breaking not working with rolling log files

bishtk — Wed, 30 Sep 2020 00:00:56 GMT

Log file name : run_xxxxxxx_XXX_XXXXXX_XXX.log.04020830

This is the log file name and its suffix always ends with current date. So it gets rolled everyday into a new file with new date.
For this I have added crcSalt in inputs.conf file.

Pasted below is the log event format. Where "beginning" line is the start of event and "ending" line is the end of event. This is one complete event
23:30:05 =================/XXX/XXXXXX/run_XXX.ksh beginning=================
**
23:30:15 =================/XXX/XXXXXX/run_XXX.ksh ending====================

For this I have applied below parsing under props.conf of heavyforwarder
[source::/XXX/XXXXXX/XXX/XXX/.log.]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{1,2}:\d{1,2}:\d{1,3}\s.*\sbeginning

This parsing is working when I tested the same on local machine or test environment with single log file. But in production, since there it creates a rolling log file everyday, this line breaking is not working.

Please suggest?

Thanks in advance

Re: Line breaking not working with rolling log files

bishtk — Wed, 03 Apr 2019 12:01:39 GMT

Any expert advice splunkers?

Re: Line breaking not working with rolling log files

kamlesh_vaghela — Wed, 03 Apr 2019 12:06:25 GMT

@kundanbisht

Have you tried with this? I have just added *.

[source::/XXX/XXXXXX/XXX/XXX/.log.*]

Re: Line breaking not working with rolling log files

bishtk — Wed, 03 Apr 2019 13:46:41 GMT

Hi @kamlesh_vaghela these pre-requisites/basic steps are already in place (although i missed that in description). What I am looking for here is that even after all those steps, breaking is not happening properly.
And I am doubting the cause behind it is rolling log file. So need to know if any specific step or variable is there to add for this rolling log file line parsing?