All Apps and Add-ons

Alert Manager: How to prevent long comments (with new line) from being split into multiple events?

americob
Explorer

While testing comments, I've found that when we entered a long comment (copied a 219 word / 2 paragraph text fromhttp://lipsum.com/feed/html ) they are split into 3 events. The first event has the fields time, serverity, origin, event_id, user, action, incident_id, comment. The comment is split so the second paragraph is located in a second event (no fields) and the 3rd event has only the closing quotes.

Thanks,
Americo

Tags (2)
0 Karma
1 Solution

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

View solution in original post

Simon
Contributor

Thanks for the report. I confirm that this is a bug. I'll have a look and provide a workaround and a solution in the source code.
By the way, I opened a bug report at GitHub:
https://github.com/simcen/alert_manager/issues/131

0 Karma

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...