Developing for Splunk Enterprise

Unwanted line breaking when running a Python script

mrrci
Explorer

Hey there Splunk community. I'm new here and I would appreciate some help if it is possible.

I'm running a Python script that generates a 4 line event inside my Splunk app. The strange thing about it is that it always generates the same amount of characters (spread across 4 lines) and my events still break into 2 linecounts 20% of the time. I don't see any pattern whatsoever. Is there a way to solve this?

Screenshot_2022-04-25_20_51_39.png

Labels (3)
0 Karma
1 Solution

VatsalJagani
Champion

@mrrci - Check your sourcetype's props.conf for line breaker and timestamp extraction.

[<your sourcetype>]
LINE_BREAKER = ([\n\r]+)\d{8}[\n\r]+
SHOULD_LINEMERGE = false
TRUNCATE = 100

 

Please also set the following parameters for timestamp extraction, if you have not set already.

TIME_PREFIX = regex of the text that leads up to the timestamp
MAX_TIMESTAMP_LOOKAHEAD = how many characters for the timestamp
TIME_FORMAT = strptime format of the timestamp

 

I hope this helps!! Upvote/Karma would be appreciated!!!!

View solution in original post

PickleRick
Ultra Champion

And how does your _time correspond to those events? Because at first glance I'd also suspect that Splunks tries automagically to "fit" some date format to your number and breaks "before timestamp".

VatsalJagani
Champion

@mrrci - Check your sourcetype's props.conf for line breaker and timestamp extraction.

[<your sourcetype>]
LINE_BREAKER = ([\n\r]+)\d{8}[\n\r]+
SHOULD_LINEMERGE = false
TRUNCATE = 100

 

Please also set the following parameters for timestamp extraction, if you have not set already.

TIME_PREFIX = regex of the text that leads up to the timestamp
MAX_TIMESTAMP_LOOKAHEAD = how many characters for the timestamp
TIME_FORMAT = strptime format of the timestamp

 

I hope this helps!! Upvote/Karma would be appreciated!!!!

burwell
SplunkTrust
SplunkTrust

Is there a timestamp on your lines?

Do you have props for this sourcetype?

mrrci
Explorer

Yes, I created a sourcetype.

0 Karma