topic How to line break raw events in Splunk Search

How to line break raw events

Sailesh6891 — Mon, 02 Dec 2024 13:04:46 GMT

Hi,

I have a log file on the server which I ingested in splunk through input app where I defined the index , sourcetype and monitor statement in inputs.conf. Log file on the server looks like below:

xyz
asdfoasdf
asfanfafd
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
sdfsdfja
agf[oija[gfojerg
fgoaierr
apodsifa[soigaiga[oiga[dogj
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
sadfnasd;fiasfdoiasndf'i
dfdf
fd
garehaehseht
shse
thse
tjst
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
asdf;nafdsknasdf
asdfknasdfln
asdf;nasdkfnasf
asogja'fja
foj'apogj
aogj
agf

When I try searching the log file in splunk, Logs are visible howerver events are not breaking as I expect it to come. I want events to be separated as below

Event 1:

xyz
asdfoasdf
asfanfafd
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Event 2:

sdfsdfja
agf[oija[gfojerg
fgoaierr
apodsifa[soigaiga[oiga[dogj

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Event 3:

sadfnasd;fiasfdoiasndf'i
dfdf
fd
garehaehseht
shse
thse
tjst

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Event 4:

asdf;nafdsknasdf
asdfknasdfln
asdf;nasdkfnasf
asogja'fja
foj'apogj
aogj
agf

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Re: How to line break raw events

gcusello — Mon, 02 Dec 2024 13:41:19 GMT

Hi @Sailesh6891 ,

did you tried to use LINE_BREKING option in props.conf?

[your-sourcetype] LINE_BREAKING = :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Ciao.

Giuseppe

Re: How to line break raw events

Sailesh6891 — Mon, 02 Dec 2024 13:50:16 GMT

No, I have not used LINE_BREAKING option.

Do I need to create a props.conf under splunk_home$/etc/apps/local/

and mention these 2 lines ?i.e [sourcetype] and LINE_BREAKING = :::::::::::::::::::

Re: How to line break raw events

gcusello — Mon, 02 Dec 2024 14:01:07 GMT

Hi @Sailesh6891 ,

it's a best practive to create a custom add-on containing all the parsing rules for your data, also because I suppose that there are other parsing rules that you need to add.

but anyway you can also put this two lines in another props.conf.

Ciao.

Giuseppe