topic Re: Helps with Props For Sample Logs in Dashboards & Visualizations

Helps with Props For Sample Logs

Ram2 — Sat, 14 Sep 2024 18:52:10 GMT

Sample logs:

Mon Sep 04 13:23:40 2024 -- (eMonitoringLATN_install.sh) Your current directory is [/d/onedemand/etc]

Mon Sep 05 12:21:30 2024 -- (eMonitoringLATN_install.sh) Final Destination reached logs.

Mon Sep 06 12:21:30 2024 -- (eMonitoringLATN_install.sh) logs ingestion started.

We tried below props for above sample logs but line breaking not happening correctly. And pls let us know how to give time format as well.

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\w+\s\w+\s\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}
TIME_PREFIX=^

PickleRick — Sat, 14 Sep 2024 21:14:27 GMT

1. How are you ingesting your events?

2. Where (on which component) did you put these settings?1

inventsekar — Sun, 15 Sep 2024 00:09:09 GMT

Hi @Ram2
Same questions of @PickleRick :

Looks like you are reading app logs from linux, thru Splunk UF (or HF)

1) pls confirm are you using UF or HF (or directly reading at indexer?)

2) are you ingesting these logs thru some Splunk TA / App / Add-on's?

Ram2 — Sun, 15 Sep 2024 01:52:45 GMT

Looks like you are reading app logs from linux, thru Splunk UF (or HF) yes from Splunk UF

1) pls confirm are you using UF or HF (or directly reading at indexer?) using UF

2) are you ingesting these logs thru some Splunk TA / App / Add-on's? No

inventsekar — Tue, 17 Sep 2024 09:11:46 GMT

Hi @Ram2 ...May i know what happens when you try this props:

SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) TIME_PREFIX=^