Getting Data In

“Create Source Type” inquiry

RK_sp1unk
New Member

“Create Source Type” inquiry.

We want to create a new sourcetype that break events based a word orderActivityRep { and the event ends with }.

How to do it

The logs arrive to Splunk in this format: Example:

orderActivityRep {
secBoardId {
securityIdType void,
secCode "GFH",
boardId "REGULAR"
},
orderId {
orderDate 20190731,
orderNo 9999,
orderNoSuffix 0,
speedIndex -1
},
orderStatus unplaced,
orderEvent place,
buySell sell,
quantity {
value 20000,
decimals 0
},
duration goodTillCancelled,
}

orderActivityRep {
secBoardId {
securityIdType void,
secCode "NBB",
boardId "REGULAR"
},
orderId {
orderDate 20120111,
orderNo 9999,
orderNoSuffix 0,
speedIndex -1
},
orderStatus unplaced,
orderEvent place,
buySell sell,
quantity {
value 2001,
decimals 0
},
duration goodTillCancelled,
}

In the above example Splunk should create 2 events.

0 Karma
1 Solution

gcusello
Legend

Hi @RK_sp1unk,
you should use a props.conf like this:

[your_sourcetype]
SHOULD_LINEMERGE = true
LINE_BREAKER = orderActivityRep \{
TIME_PREFIX = orderDate\s
TIME_FORMAT = %Y%m%d

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @RK_sp1unk,
you should use a props.conf like this:

[your_sourcetype]
SHOULD_LINEMERGE = true
LINE_BREAKER = orderActivityRep \{
TIME_PREFIX = orderDate\s
TIME_FORMAT = %Y%m%d

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...