Trouble splitting events correctly

nwenzl_splunk — Wed, 30 Sep 2020 04:40:14 GMT

Hello Splunkers,

I'm having trouble getting some weblogs to show up correctly in Splunk. What I'm trying to index looks like this:

201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4"&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)"

Every event is separated by &&& and so far I've managed the events to split somewhat correctly, but can't get rid of the &&& that still shows up at the beginning of each event:

&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)"

props.conf:

LINE_BREAKER = (\d+)&&&(\d+)
NO_BINARY_CHECK = true
REPORT-access = access-extractions
SHOULD_LINEMERGE = false
TIME_PREFIX = \[
TRUNCATE = 0
category = Custom
disabled = false
maxDist = 28
pulldown_type = true

I've also tried using things like MUST_BREAK_AFTER = .+?(?=&&&) but that didn't help either.
Anybody who can offer any advice?

Re: Trouble splitting events correctly

richgalloway — Fri, 20 Mar 2020 13:12:46 GMT

The LINE_BREAKER setting breaks lines at the first capture group discards the contents of that group. Try LINE_BREAKER = \d+(&&&)\d+.

Re: Trouble splitting events correctly

nwenzl_splunk — Fri, 20 Mar 2020 13:38:29 GMT

Thanks for your answer, I had already figured it out in the meantime. LINE_BREAKER = (&&&)(\d+) worked.

topic Re: Trouble splitting events correctly in Getting Data In

Trouble splitting events correctly

Re: Trouble splitting events correctly

Re: Trouble splitting events correctly