topic Re: Splunk data doesn't split correctly in Splunk Search

Splunk data doesn't split correctly

zhoayang — Fri, 28 Jan 2022 07:31:52 GMT

Hi Splunk team,

When I used Splunk to search the log data and found it didn't split correctly, It displayed as below:

The two data have been combined together, Can anyone has some suggestions do this situation? appreciate it.

Re: Splunk data doesn't split correctly

gcusello — Fri, 28 Jan 2022 07:36:06 GMT

Hi @zhoayang,

could you share some sample of your original logs (not the oned displayed in Splunk search)?

please one of the event correctly parsed and one of the event not correctly parsed.

Anyway, in Community you can find many examples of JSON parsing e.g. https://community.splunk.com/t5/Getting-Data-In/How-to-parse-JSON-log-data/m-p/121521.

Ciao.

Giuseppe

Re: Splunk data doesn't split correctly

yuanliu — Fri, 28 Jan 2022 10:15:51 GMT

It looks like a problem with LINE_BREAKER in props.conf. (See Configure event line breaking.) By default Splunk indexer assumes "([\r\n]+)", i.e., a new line, to be the separator of events. But some logs seem to have jammed into a single line. There is no universal regex to break non-hierarchical structures like JSON. So, it is best to ask developers to break events neatly. If developers can guarantee that the first field is always "namespace" as in illustrated examples, you can try ([\r\n]+|}{"namespace":).

There is a dedicated forum Getting Data In in which this type of issues are discussed.