Getting Data In

Apache log entries concatenated into single event

splunkus
Engager

Hi,

We have been testing Splunk processing Apache access logs that we have defined using a custom log entry to output key=value pairs. For the last month everything has been working nicely, allowing us to search based on field names and values.

For example, source_type="apachekv" field1 > 30 etc

But what we have recently noticed is that for one event in the Splunk Web UI, we are now getting 2,3 or more or more apache access lines concatenated into one single Splunk event being displayed.When I look at the raw apache logfile, each entry is on a single line and looks ok.

We are using version 4.3.3, build 128297.

Has anyone seen this before. I did see an old Changelog entry (12/5/2011) about a fix for concatenated lines in Apache.

Cheers / Frank

Tags (2)
0 Karma

Takajian
Builder

We can configure how splunk treat event break. Please refer to the link as bellow.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents

By default, splunk break event with timestamp that splunk can recognize. The setting is "BREAK_ONLY_BEFORE_DATE = true". I do not know your apache log format, but there is possibility that splunk can not recognize timestamp of your apache log so that splunk can not break each events properly.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...