topic Split up multiline values in Splunk Search

Split up multiline values

secphilomath1 — Tue, 05 Mar 2024 21:19:57 GMT

I am trying to run the following search:

index=tripwire LogCategory="Audit Event" AND "/etc/pki/rpm-gpg/RPM-GPG-KEY-shibboleth-7" AND "myserver.mydomain.com"
| rex max_match=0 field=_raw "(?<lineData>[^\n]+)"
| rex field=Msg "'(?<FilePath>.*)' accessed by"
| rex field=_raw "accessed\sby\s'(?<Audit_UserName>.*)'.\sType"

| table _time, FilePath, Audit_UserName

However, the way I am splitting the multiline data doesn't appear to be working with this data.

Here is a sample of the data as viewed in Notepad++ with symbols;

Every line ends in CR LF

However, in Splunk it isn't splitting up the events. What am I missing here? I have had this work with similar data but unsure what is different in this situation.

TIA!

Re: Split up multiline values

burwell — Tue, 05 Mar 2024 21:39:36 GMT

Hi so how is are the events being split by Splunk? And do you have any props to tell splunk how to split the events?

Re: Split up multiline values

secphilomath1 — Tue, 05 Mar 2024 21:40:35 GMT

Not yet no

Re: Split up multiline values

burwell — Tue, 05 Mar 2024 21:55:44 GMT

I can't quiet tell what is the input data and how Splunk is splitting.

Do you want separate events for each time you have Feb 13 etc? If so provide a props for your indexers to say that the event starts with the date at the beginning of the line etc.