topic Separating merged events in Splunk Search

Separating merged events

rgcox1 — Sat, 31 Jul 2010 04:52:26 GMT

I'm trying to develop a regex to separate merged events from a log. Here's my stanza in props.conf:

[source=c:\temp\nagios*-perfdata]
SHOULD_LINEMERGE = true
LINE_BREAKER = ([\r\n]+)
BREAK_ONLY_BEFORE = ^DATATYPE::

I've tried various regex's for BREAK_ONLY_BEFORE, all of which work in my regex tester.
Don't think I really need LINE_BRAKER, but have tried with and without.
Any help would be appreciated.

Re: Separating merged events

gkanapathy — Sat, 31 Jul 2010 05:02:48 GMT

It's not [source=path], it should be [source::path].
Furthermore, \ (backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
And for Windows file paths, it's probably a good idea to make the source match case-insensitive, so: [source::(?i)c:\\temp\nagios*-perfdata]
You can't add comments in Splunk config files with a # except at the beginning of a line, i.e., if the comment with # tried with and without... are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+), what you think is a comment is taken as part of the line breaker regex.
Neither of these settings is necessary normally as it looks like you're trying to set them to the default values in Splunk anyway.

Re: Separating merged events

rgcox1 — Sat, 31 Jul 2010 05:30:24 GMT

Thanks. That got it working on my test instance on Windows, so I moved it to the production Linux box and it's working great!