Deployment Architecture

Why is stanza for inputs conf is not working?

Naa_Win
Path Finder

Hello,

I have a folder where I have different types of files in it and want to monitor the whole folder as one sourcetype with different props.conf 

inputs.conf

[monitor:///mydata/my_folder/ToSplunk/*.(mylogfile|edi.mylogfile|edi)]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>

Props.conf

[XYZ_SRCTYPE]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\~|\r\n)ST\*834\*
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 1

As I said I have different files, I wrote different props.conf for specific log structure to break the events. 

[source::/mysource/ToSplunk/*.xml.*.edi]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]+)\<Policy\>[\r\n\s]+
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 5

[source::/mysource/ToSplunk/*.COMPARE.xml.*.edi]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]+)\<CompareMissing\>[\r\n\s]+
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 6

[source::/mysource/ToSplunk/*.SBS*.xml.edi]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s])+\<Policy\s+
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 7

[source::/mysource/ToSplunk/*.RCNO*.P.OUT.*]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 8

The linebreaking in first stanza declared for the sourcetype is working fine, but none of the stanzas for [souce://] are breaking the events correctly

Labels (1)
0 Karma
1 Solution

Naa_Win
Path Finder

pipes ( OR ) in the monitoring stanza doesn't works. so i had used blacklist & whitelist concept to work it out. 

[monitor:///mydata/my_folder/ToSplunk/*.]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>
blacklist = (xml.*.edi|COMPARE.xml.*.edi|RCNO*.P.OUT.*|SBS*.xml.edi)

With this is will blacklist the source and i wrote separate stanza for backlisted  sources and it worked. 

 

View solution in original post

0 Karma

Naa_Win
Path Finder

pipes ( OR ) in the monitoring stanza doesn't works. so i had used blacklist & whitelist concept to work it out. 

[monitor:///mydata/my_folder/ToSplunk/*.]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>
blacklist = (xml.*.edi|COMPARE.xml.*.edi|RCNO*.P.OUT.*|SBS*.xml.edi)

With this is will blacklist the source and i wrote separate stanza for backlisted  sources and it worked. 

 

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...