splunk event splitting

mm12 — Tue, 21 Sep 2021 08:03:34 GMT

I have a log file below format and props.conf wriiten below. I am getting first four lines as one event and the remaining lines as separate events. But I want as single event . Can anyone help me on this.

********************************************************************************
product = WebSphere Application Server 20.0.0.3 (wlp-1.0.38.cl200320200305-1433)
wlp.install.dir = /opt/IBM/wlp/
java.home = /opt/IBM/sdk/jre
java.version = 1.8.0_241
java.runtime = Java(TM) SE Runtime Environment (8.0.6.7 - pxa6480sr6fp7-20200312_01(SR6 FP7))
os = Linux (3.10.0-1160.11.1.el7.x86_64; amd64) (en_GB)
process = 29193@128.161.210.72
********************************************************************************
[17/09/21 16:40:27:860 BST] 00000001 com.ibm.ws.kernel.launch.internal.FrameworkManager I CWWKE0002I: The kernel started after 3.119 seconds
[17/09/21 16:40:28:003 BST] 0000003b com.ibm.ws.kernel.feature.internal.FeatureManager I CWWKF0007I: Feature update started.
[17/09/21 16:40:28:809 BST] 0000003b com.ibm.ws.config.xml.internal.ConfigEvaluator W CWWKG0033W: The value [localHostOnly] specified for the reference attribute [allowFromEndpointRef] was not found in the configuration.
[17/09/21 16:40:29:051 BST] 00000030 com.ibm.ws.security.ready.internal.SecurityReadyServiceImpl I CWWKS0007I: The security service is starting...
[17/09/21 16:40:29:524 BST] 00000032 com.ibm.ws.annocache.service I OSGi Work Path [ /opt/IBM/wlp/usr/servers/e2/workarea/org.eclipse.osgi/43/data ]
[17/09/21 16:40:31:924 BST] 00000031 com.ibm.ws.app.manager.internal.monitor.DropinMonitor A CWWKZ0058I: Monitoring dropins for applications.
[17/09/21 16:40:33:586 BST] 00000031 com.ibm.ws.cache.ServerCache I DYNA1001I: WebSphere Dynamic Cache instance named baseCache initialized successful

props.conf
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
BREAK_ONLY_BEFORE = (.\d{7}.\d\d:\d\d:\d\d.\d\d)
MAX_TIMESTAMP_LOOKAHEAD = 18
DATETIME_CONFIG =
TIME_FORMAT = %d/%m/%y %H:%M:%S:%3N %z
TZ = BST
TIME_PREFIX = "^
TRUNCATE = 0

Re: splunk event splitting

richgalloway — Tue, 21 Sep 2021 12:42:14 GMT

The BREAK_ONLY_BEFORE_DATE separates events at dates so it should be no surprise that each line is a new event.

Try these settings to get the whole set into a single event.

LINE_BREAKER = ([\r\n]+)product = SHOULD_LINEMERGE = true MAX_TIMESTAMP_LOOKAHEAD = 18 TIME_FORMAT = %d/%m/%y %H:%M:%S:%3N %Z TIME_PREFIX = ^\[ TRUNCATE = 0

Re: splunk event splitting

mm12 — Tue, 21 Sep 2021 13:41:25 GMT

Thanks. I have tried that still I am not getting as single event

Re: splunk event splitting

richgalloway — Tue, 21 Sep 2021 14:13:16 GMT

Just noticed SHOULD_LINEMERGE should be "false", though it may not make much difference.

topic Re: splunk event splitting in Splunk Search

splunk event splitting

Re: splunk event splitting

Re: splunk event splitting

Re: splunk event splitting