topic Re: Line break or merge? in Splunk Search

Line break or merge?

rmsit — Tue, 23 Jan 2018 19:53:44 GMT

Hi all,

How would I go about merging multiple values on multiple lines so all values are captured? Currenlty, I am only seeing values from the first line. Data below.

2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="135" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID="860"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="443" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="4"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="445" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="4"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="3389" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID="2480"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="4445" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="enstart64" PID="1760"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="5985" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="4"
2018-01-23 13:48:42 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="8089" RemoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="splunkd" PID="10180"

Thanks!

Re: Line break or merge?

somesoni2 — Tue, 23 Jan 2018 20:03:43 GMT

Do all these lines part of one Splunk event? OR they appear (each line with timestamp) as separate event?

Re: Line break or merge?

rmsit — Tue, 23 Jan 2018 20:14:14 GMT

Believe so. Each line begins with a timestamp and there are several values for the fields shown that appear on each line. This is a dump of the netstat -ano command on a Windows server.

Re: Line break or merge?

JordanPeterson — Thu, 25 Jan 2018 01:18:25 GMT

You can use props.conf to prevent line breaking but you will need a unique identifier at the end or beginning of your event. Then you can use RegEx to locate that identifier to group everything.

https://docs.splunk.com/Documentation/Splunk/7.0.1/Data/Configureeventlinebreaking

Re: Line break or merge?

rmsit — Thu, 25 Jan 2018 14:26:48 GMT

This has been resolved. I was using the incorrect sourcetype.

Re: Line break or merge?

rmsit — Thu, 25 Jan 2018 14:32:37 GMT

Also answered here: link text