All Apps and Add-ons

Alert Manager: How to prevent long comments (with new line) from being split into multiple events?

americob
Explorer

While testing comments, I've found that when we entered a long comment (copied a 219 word / 2 paragraph text fromhttp://lipsum.com/feed/html ) they are split into 3 events. The first event has the fields time, serverity, origin, event_id, user, action, incident_id, comment. The comment is split so the second paragraph is located in a second event (no fields) and the 3rd event has only the closing quotes.

Thanks,
Americo

Tags (2)
0 Karma
1 Solution

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

View solution in original post

Simon
Contributor

Thanks for the report. I confirm that this is a bug. I'll have a look and provide a workaround and a solution in the source code.
By the way, I opened a bug report at GitHub:
https://github.com/simcen/alert_manager/issues/131

0 Karma

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...