topic Re: Need help for line breaking in Dashboards & Visualizations

Need help for line breaking

RobertRi — Wed, 20 Nov 2013 06:54:56 GMT

I have a problem with an logifle wich has over 95% single line events and a few multiline events.

These multiline events have this format

START*A .....
   ....
   ....
   ....
END

How can I configure I splunk to keep this lines together as a one multiline event?

Thanks for your help
Rob

Re: Need help for line breaking

gkanapathy — Wed, 20 Nov 2013 07:08:18 GMT

what do the single line events look like?

Re: Need help for line breaking

RobertRi — Wed, 20 Nov 2013 07:12:01 GMT

The single lines are really different
They begin with ..

XSET
XGET
START ......... END
?
XKS
XDEL

Re: Need help for line breaking

gkanapathy — Wed, 20 Nov 2013 07:23:02 GMT

So, with the multi-line events, are the inner lines actually indented with spaces or tabs? Or is that just how you formatted it?

Re: Need help for line breaking

gkanapathy — Wed, 20 Nov 2013 07:24:00 GMT

Then:

[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?:XSET|XGET|START|\?|XKS|XDEL)

may do it. Or,

[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?!(?:END|\t))

Re: Need help for line breaking

RobertRi — Wed, 20 Nov 2013 07:25:25 GMT

Yes, the inner multiline lines are indented with tabs

Re: Need help for line breaking

RobertRi — Mon, 28 Sep 2020 15:19:24 GMT

I have played around with the data preview in the UI (really cool thing!) and found that this works too.

MUST_NOT_BREAK_AFTER=^START\*\w+\s
MUST_BREAK_AFTER=^END
SHOULD_LINEMERGE= true

In case of performance, did you recommend your solution with the LINE_BREAKER or my way?

Thank you very much for your help!
Rob

Re: Need help for line breaking

gkanapathy — Mon, 28 Sep 2020 15:19:30 GMT

for best performance, you want to set SHOULD_LINEMERGE = false, which disables all rules other than LINE_BREAKER. but generally indexing performance is not a problem and so a clearer rule may be better.