topic Logs not showing up in Dashboards & Visualizations

Logs not showing up

mahesh27 — Wed, 11 Sep 2024 14:13:37 GMT

Using below props, but we don't see logs reporting to Splunk, We are assuming that | (pipe symbol) works as a delimiter and we cannot use it in props.
Just want to know is this props are correct

[tools:logs]

SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\d{4}\-\d{2}\-\d{2}\s\|\d{2}:\d{2}:\d{2}.\d{3}\s\| TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d | %H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=28

Sample logs:

2022-02-22 | 04:00:34:909 | main stream logs | Staticapp-1 - Restart completed

2022-02-22 | 05:00:34:909 | main stream applicationlogs | Staticapp-1 - application logs (total=0, active=0, waiting=0) completed

2022-02-22 | 05:00:34:909 | main stream applicationlogs | harikpool logs-1 - mainframe script (total=0, active=0, waiting=0) completed

Re: Logs not showing up

gcusello — Wed, 11 Sep 2024 06:13:02 GMT

Hi @mahesh27 ,

two questions:

do you see logs in a wrong format or don't you see logs?

in the first case, props.conf is relevant, in the second case, there's a different issue.

if you see your logs in wrong format, I suppose that your logs are in one row (because you used SHOULD_LINEMERGE=false), so why are you using the LINE_BREAKER in that way?

See how to index csv files using pipe as delimiter.

My hint is to same some logs in a text file and try to ingest it using the manual Add logs feature, that guides you in props.conf definition and test.

Ciao.

Giuseppe

Re: Logs not showing up

ITWhisperer — Wed, 11 Sep 2024 06:50:45 GMT

In your sample logs, it looks like you have a space after the first pipe which does not appear to be accounted for in your LINE_BREAKER pattern. Try something like this

LINE_BREAKER=([\r\n]+)\d{4}\-\d{2}\-\d{2}\s\|\s\d{2}:\d{2}:\d{2}.\d{3}\s\|