All Apps and Add-ons

Alert Manager: How to prevent long comments (with new line) from being split into multiple events?

americob
Explorer

While testing comments, I've found that when we entered a long comment (copied a 219 word / 2 paragraph text fromhttp://lipsum.com/feed/html ) they are split into 3 events. The first event has the fields time, serverity, origin, event_id, user, action, incident_id, comment. The comment is split so the second paragraph is located in a second event (no fields) and the 3rd event has only the closing quotes.

Thanks,
Americo

Tags (2)
0 Karma
1 Solution

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

View solution in original post

Simon
Contributor

Thanks for the report. I confirm that this is a bug. I'll have a look and provide a workaround and a solution in the source code.
By the way, I opened a bug report at GitHub:
https://github.com/simcen/alert_manager/issues/131

0 Karma

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.