Splunk Search

Break Events from a single Event

Shashank_87
Explorer

Hi, I have this weird logging from one of the application where it is logging multiple users in a single event with a different timestamp and a thread name. I am actually trying to find out number of logins per day but how do I extract this data of single events consist of multiple events.
Example - below is a single event contains the data for 2 users. How do I break it probably using the timestamp or threadname?

[catalina-exec-86] 19Jun18-11:31:00 INFO (test.java:31)-{"id":null,"clientip":"1.16.9.13","currentRuntimeId":"0","currentUserId":"0","currentUsername":"test@gmail.com","unixTimestamp":"988","verb":"POST","request":"/test/start","response":"0","bytes":null,"httpversion":null,"referrer":"https://test","uaString":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36","threadName":"thread12","actionName":"test","hasEnriched":"false","country":"test","enrichment.protocol":"test","enrichment.username":"test@gmail.com"}
[catalina-exec-38] 19Jun18-11:31:01 INFO (test.java:31)-{"id":null,"clientip":"12.1.96.18","currentRuntimeId":"0","currentUserId":"0","currentUsername":"test123@abc.com","unixTimestamp":"099","verb":"POST","request":"/test/start","response":"0","bytes":null,"httpversion":null,"referrer":"https://test","uaString":"Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15F79","threadName":"thread24","actionName":"test","hasEnriched":"false","country":"test","enrichment.protocol":"test","enrichment.username":"test123@abc.com"}

Any help would be much appreciated.

Tags (1)
0 Karma
1 Solution

rteja9
Path Finder

You need to line break the events into individual events. This can be done either on HF or on indexers.
Below is the document explaining how to enable event line breaking on Splunk,
https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Configureeventlinebreaking

Basically Splunk auto line breaks based on timestamp value. But in your case as event doesn't start with timestamp, you need to explicitly specify line breaking configuration.
You can try below configuration,
props.conf
[]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE = ^[catalina-exec-

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You need to apply base configs on your indexer(s) to break the events up

LINE_BREAKER=\[catalina-exec\-\d+\]
SHOULD_LINE_MERGE=false
TRUNCATE=1000

Restart splunkd on the indexer(s) after adding this

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

To confirm: I see two events (starting with [catalina-exec-nn]). Are you saying your log source does not have a carriage return/new line between the two?

This should do what you need if that's the case:
BREAK_ONLY_BEFORE = [catalina-exec-\d+]
TIME_FORMAT = %d%b%y-%H:%M:%S
TIME_PREFIX = [catalina-exec-\d+]\s

0 Karma

rteja9
Path Finder

You need to line break the events into individual events. This can be done either on HF or on indexers.
Below is the document explaining how to enable event line breaking on Splunk,
https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Configureeventlinebreaking

Basically Splunk auto line breaks based on timestamp value. But in your case as event doesn't start with timestamp, you need to explicitly specify line breaking configuration.
You can try below configuration,
props.conf
[]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE = ^[catalina-exec-

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should use LINE_BREAKER over BREAK_ONLY_BEFORE and should stay away from SHOULD_LINEMERGE=true

0 Karma

Shashank_87
Explorer

Yes that worked perfectly. Thank you very much for the response

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Foolish...

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...