topic Re: Splitting one event into multiple events in Splunk Search

Splitting one event into multiple events

Branden — Fri, 17 Dec 2010 23:28:53 GMT

This should be a simple question. In fact, I've succeeded in doing this before, but I no longer have that app and I can't recall the solution.

I run a script that outputs something like the following:

Queue          Status
-----          ------
MTAB208A       READY
MTAB310C       READY
MTAB318A       READY
MTAB318B       READY

I want Splunk to alert me when the "READY" status changes to "DOWN" (or something other than "READY").

So I wrote a script that uses sed to remove the first two lines, so the output becomes:

MTAB208A       READY
MTAB310C       READY
MTAB318A       READY
MTAB318B       READY

I want Splunk to extract two fields: queue and status. This is easy enough except I want each of those queues to be its own event. Instead, I get one big event containing all four queues.

How do I get each of those queues to be its own event? I know there's an easy way to do this but I'm having a mind block here. (I suppose the other option is to do away with the sed trimming and use multikv, but I think that might over-complicate this.)

I tried using LINE_BREAKER in props.conf but that didn't do anything:

LINE_BREAKER = ^\w+\s+\w+

Update: Figured it out! I needed to use "MUST_BREAK_AFTER". Oh yeah, and bounce Splunk after updating props.conf.

Thanks!

Re: Splitting one event into multiple events

ziegfried — Sat, 18 Dec 2010 00:02:04 GMT

You should split the events at index time by specifying something like this in your props.conf:

[your_sourcetype]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

Re: Splitting one event into multiple events

Branden — Mon, 28 Sep 2020 09:22:14 GMT

Aaaah okay. I got it working with: MUST_BREAK_AFTER = ^\w+\s+\w+ Does that seem reasonable too? Thanks!

Re: Splitting one event into multiple events

AmitKapila — Tue, 29 Sep 2020 14:05:22 GMT

I tried it after changing /opt/splunkforwarder/etc/apps/Metro_TA_iibcorp/local/props.conf but it fails again to split the EventType.

[metro:iibcorpqmon]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

Is the props .conf in the correct place?

Re: Splitting one event into multiple events

aaraneta_splunk — Tue, 16 May 2017 15:03:42 GMT

@AmitKapila - This question is quite old and it may not garner the type of attention and activity that you seek. I would suggest posting a new question. Thank you.