Deployment Architecture

Why is stanza for inputs conf is not working?

Naa_Win
Path Finder

Hello,

I have a folder where I have different types of files in it and want to monitor the whole folder as one sourcetype with different props.conf 

inputs.conf

[monitor:///mydata/my_folder/ToSplunk/*.(mylogfile|edi.mylogfile|edi)]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>

Props.conf

[XYZ_SRCTYPE]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\~|\r\n)ST\*834\*
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 1

As I said I have different files, I wrote different props.conf for specific log structure to break the events. 

[source::/mysource/ToSplunk/*.xml.*.edi]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]+)\<Policy\>[\r\n\s]+
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 5

[source::/mysource/ToSplunk/*.COMPARE.xml.*.edi]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]+)\<CompareMissing\>[\r\n\s]+
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 6

[source::/mysource/ToSplunk/*.SBS*.xml.edi]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s])+\<Policy\s+
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 7

[source::/mysource/ToSplunk/*.RCNO*.P.OUT.*]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TRUNCATE=999999
CHARSET=UTF-8
priority = 8

The linebreaking in first stanza declared for the sourcetype is working fine, but none of the stanzas for [souce://] are breaking the events correctly

0 Karma
1 Solution

Naa_Win
Path Finder

pipes ( OR ) in the monitoring stanza doesn't works. so i had used blacklist & whitelist concept to work it out. 

[monitor:///mydata/my_folder/ToSplunk/*.]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>
blacklist = (xml.*.edi|COMPARE.xml.*.edi|RCNO*.P.OUT.*|SBS*.xml.edi)

With this is will blacklist the source and i wrote separate stanza for backlisted  sources and it worked. 

 

View solution in original post

youngc_splunk
Splunk Employee
Splunk Employee

@Naa_Win , we do have an EDI solutions accelerator.  Love to connect and give you some dump on the solution. Let me know if you are interested.

0 Karma

Naa_Win
Path Finder

Sure ! Thanks. Let me know how we can do this

0 Karma

youngc_splunk
Splunk Employee
Splunk Employee

My email is youngc@splunk.com

Please send me an email, I will send a zoom meeting invite for us to connect.

0 Karma

Naa_Win
Path Finder

pipes ( OR ) in the monitoring stanza doesn't works. so i had used blacklist & whitelist concept to work it out. 

[monitor:///mydata/my_folder/ToSplunk/*.]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>
blacklist = (xml.*.edi|COMPARE.xml.*.edi|RCNO*.P.OUT.*|SBS*.xml.edi)

With this is will blacklist the source and i wrote separate stanza for backlisted  sources and it worked. 

 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...