topic Re: splunk data input in Getting Data In

splunk data input

syloee — Mon, 28 Jun 2021 05:22:01 GMT

This is data file( ip -- [time] text &&& ip -- [time] text &&& ip -- [time] text &&&)

41.146.8.66 - - [13/Jan/2016 21:03:09:200] "POST /category.screen?category_id=SURPRISE&JSESSIONID=SD1SL2FF5ADFF3 HTTP 1.1" 200 3496 "http://www.myflowershop.com/cart.do?action=view&itemId=EST-16&product_id=RP-SN-01" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4" 294&&&130.253.37.97 - - [13/Jan/2016 21:03:09:185] "GET /category.screen?category_id=BOUQUETS&JSESSIONID=SD7SL2FF1ADFF8 HTTP 1.1" 200 2320 "http://www.myflowershop.com/cart.do?action=changequantity&itemId=EST-12&product_id=AV-CB-01" "Opera/9.20 (Windows NT 6.0; U; en)" 361&&&141.146.8.66 - -

-> i want to this ↓

ip -- [time] text

What can I do? (use LINE_BREAKER, etc)

Re: splunk data input

kamlesh_vaghela — Mon, 28 Jun 2021 06:12:16 GMT

@syloee

Just change YOUR_SOURCETYPE with your original sourcetype.

[ YOUR_SOURCETYPE ] SHOULD_LINEMERGE=true LINE_BREAKER=(&&&) NO_BINARY_CHECK=true

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: splunk data input

venkatasri — Mon, 28 Jun 2021 06:16:51 GMT

Hi @syloee

Can you try this, you should set Timestamp extraction settings as well and the following props.conf should be deployed to HF/indexer.

As per docs,

NOTE: You get a significant boost to processing speed when you use
  LINE_BREAKER to delimit multi-line events (as opposed to using
  SHOULD_LINEMERGE=true to reassemble individual lines into multi-line events).

[<your_sourcetype>] SHOULD_LINEMERGE=false LINE_BREAKER=(&&&)\d+.\d+.\d+.\d+

---

An upvote would be appreciated and Accept solution if it helps!

Re: splunk data input

syloee — Mon, 28 Jun 2021 06:49:18 GMT

Re: splunk data input

syloee — Mon, 28 Jun 2021 06:49:28 GMT

to. kamlesh_vaghela, venkatasri

thankyou

Re: splunk data input

Rkyadav0235 — Wed, 15 Sep 2021 06:45:48 GMT

I am not getting events data,could you help me