Getting Data In

Why does the file without line feeds and carriage does not run?

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I have a file without CR al LF to divide events.
I usually parsed these files without problems (e.g. SAP logs), but now I don't know why it doesn't run!
this is an example of my file

141.146.8.66 - - [13/Jan/2016 21:03:09:200] "POST /category.screen?category_id=SURPRISE&JSESSIONID=SD1SL2FF5ADFF3 HTTP 1.1" 200 3496 "http://www.myflowershop.com/cart.do?action=view&itemId=EST-16&product_id=RP-SN-01" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4" 294&&&130.253.37.97 - - [13/Jan/2016 21:03:09:185] "GET /category.screen?category_id=BOUQUETS&JSESSIONID=SD7SL2FF1ADFF8 HTTP 1.1" 200 2320 "http://www.myflowershop.com/cart.do?action=changequantity&itemId=EST-12&product_id=AV-CB-01" "Opera/9.20 (Windows NT 6.0; U; en)" 361&&&141.146.8.66 - - [13/Jan/2016 21:03:09:167] "GET /product.screen?product_id=RP-LI-02&JSESSIONID=SD9SL9FF8ADFF1 HTTP 1.1" 200 3855 "http://www.myflowershop.com/cart.do?action=changequantity&itemId=EST-20&product_id=RP-LI-02" "Googlebot/2.1 ( http://www.googlebot.com/bot.html) " 929&&&

The end of an event is &&& .
I tried with SHOULD_LINEMERGE = true and false
I tried with LINE_BREAKING, MUST_BREAK_AFTER, BREAK_ONLY_BEFORE_DATE and BREAK_ONLY_BEFORE.
I tried to replace &&& with \n , but every time I continue to have only one event not divided.
Where I'm wrong? i know that it's a very stupid thing but I'm going mad!

Thank you in advance.

Bye.
Giuseppe

0 Karma
1 Solution

niketn
Legend

@cusello did you try LINE_BREAKING or LINE_BREAKER? Following setting works fine for me:

LINE_BREAKER=(&&&)

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@cusello did you try LINE_BREAKING or LINE_BREAKER? Following setting works fine for me:

LINE_BREAKER=(&&&)

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gcusello
SplunkTrust
SplunkTrust

Fantastic, as always!
but, only to understand: why must I use parenthesis?
Bye.
Giuseppe

0 Karma

niketn
Legend

Anytime!!! Paranthesis makes it capturing group. 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...