topic Re: How do I define event line-breaking in a search? in Splunk Search

How do I define event line-breaking in a search?

driekhof — Tue, 07 Mar 2017 17:10:53 GMT

Our Splunk forwarder is sending events that looks something like this:

{"consumerTstamp":1488853092650,"metric":"EvTot.byDomain","types":{"events":{}}}
{"consumerTstamp":1488853093650,"metric":"EvTot.byDomain","types":{"events":{}}}
{"consumerTstamp":1488853094650,"metric":"EvTot.byDomain","types":{"events":{}}}

This is obviously 3 events, but Splunk sees it as one. I've been looking at how to get Splunk to separate on newline in a search, but have only found things about setting some property in the configuration. How would I do this in a search?

Re: How do I define event line-breaking in a search?

driekhof — Tue, 07 Mar 2017 17:49:50 GMT

I did find a solution (I think) from searching other answers, it looks something like this:

source="/var/log/mylog/my.log.0" | rex max_match=0 field=_raw "(?[^\n]+)" | mvexpand lineData | eval _raw=lineData | sort consumerTstamp

That works but seems a little verbose for something so basic. Is there a better way?

Re: How do I define event line-breaking in a search?

pradeepkumarg — Tue, 07 Mar 2017 17:50:41 GMT

While the best practice is to fix the line breaking in props.conf, you can extract these three lines into a multivalued field using rex and then use mvexpand to seperate the events.

Re: How do I define event line-breaking in a search?

somesoni2 — Tue, 07 Mar 2017 17:53:01 GMT

The recommended method here would to be fix your sourcetype definition (props.conf on indexer/heavy forwarder) to have proper line breaking and timestamp recognition of your events. (if possible delete and re-ingest the data). If you still want to do it from search try something like this

your base search with field _raw | rex mode=sed "s/([\r\n]+)/##LF##/g" | makemv _raw delim="##LF##"
| mvexpand _raw | spath | eval _time=round(consumerTstamp/1000,3)