topic Need help with a regex for line_breaker in props.conf in Splunk Search

Need help with a regex for line_breaker in props.conf

mbachhav — Mon, 27 Sep 2021 14:07:31 GMT

Hi,

Need help with regex for LINE_BREAKER attribute in props.conf.

I have the below data and wanted it as a single event in Splunk. Currently, <RESULTS> data splits into multiple events.

I would like to send the entire <DETECTION> tag as a single event. Can someone help me provide the right LINE_BREAKER pattern to be used?

<DETECTION> <ID>231</ID> <TYPE>Information</TYPE> <SEVERITY>1</SEVERITY> <RESULTS>Line 1 : field 1 : value1 field 2: value2</RESULTS> <STATUS>NEW</STATUS> </DETECTION>

Re: Need help with a regex for line_breaker in props.conf

aasabatini — Mon, 27 Sep 2021 14:57:30 GMT

Hi @mbachhav

try this props

[<your sourcetype>] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE=\<DETECTION\>

Re: Need help with a regex for line_breaker in props.conf

mbachhav — Mon, 27 Sep 2021 15:27:08 GMT

@aasabatini,

I tried the suggested option but it's not working as expected. Data is split into multiple events.

Re: Need help with a regex for line_breaker in props.conf

aasabatini — Mon, 27 Sep 2021 15:34:17 GMT

Hi @mbachhav

can you show youe props.conf?

Regards

Alessandro

Re: Need help with a regex for line_breaker in props.conf

mbachhav — Mon, 27 Sep 2021 15:37:01 GMT

Below is my props.conf file -

[stanza]
TIMESTAMP_FIELDS=dateTime
LINE_BREAKER =\<DETECTION\>
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TZ=UTC
CHARSET=UTF-8
KV_MODE=xml
MAX_EVENTS=50000
TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ

Re: Need help with a regex for line_breaker in props.conf

aasabatini — Mon, 27 Sep 2021 15:39:55 GMT

Hi @mbachhav

please can you remove the line_breaker and add this option as told you

BREAK_ONLY_BEFORE=\<DETECTION\>

let me know if works

Re: Need help with a regex for line_breaker in props.conf

mbachhav — Mon, 27 Sep 2021 15:43:55 GMT

Apologies. First I tried with BREAK_ONLY_BEFORE=\<DETECTION\> but it didn't work hence I tried line_breaker.

Re: Need help with a regex for line_breaker in props.conf

mbachhav — Tue, 05 Oct 2021 07:30:16 GMT

Problem has been solved with below stanza -

[stanza name]

TIMESTAMP_FIELDS=dateTime
LINE_BREAKER=(\<DETECTION\s)
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TZ=UTC
CHARSET=UTF-8
KV_MODE=xml
MAX_EVENTS=50000
TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ