Hello, I have a multiline log file, but each file comes with a header that I want to discard and only use the part of the log that brings the important information, can someone help me.
Here is the original log file:
Audit file /oracle/SIC/AUDIT/SYS_OPERATIONS/ora_1695798.aud
Oracle9i Enterprise Edition Release 9.2.0.8.0 - 64bit Production
With the Partitioning option
JServer Release 9.2.0.8.0 - Production
ORACLE_HOME = /oracle/SIC/920_64
System name: AIX
Node name: duero
Release: 3
Version: 5
Machine: 00CF214F4C00
Instance name: SIC
Redo thread mounted by this instance: 1
Oracle process number: 37
Unix process pid: 1695798, image: oracle@duero (TNS V1-V3)
Sat Mar 19 06:03:53 2022
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0
Sat Mar 19 06:03:53 2022
ACTION : '/* BRARCHIVE */ CREATE PFILE = '/oracle/SIC/920_64/dbs/sap.ora' FROM SPFILE = '/oracle/SIC/920_64/dbs/spfileSIC.ora''
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0
But I only need these parts of the log:
Sat Mar 19 06:03:53 2022
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0
Sat Mar 19 06:03:53 2022
ACTION : '/* BRARCHIVE */ CREATE PFILE = '/oracle/SIC/920_64/dbs/sap.ora' FROM SPFILE = '/oracle/SIC/920_64/dbs/spfileSIC.ora''
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0
If I understand you correctly, the whole "header thing" is also a multiline "entity".
You could try setting proper event breaking, especially with BREAK_ONLY_BEFORE_DATE. That way you could check later as @gcusello showed and discard anything that - for example - doesn't start with a date.
Also for you thank you very much brother @PickleRick
Hi @zcx01067,
you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Filter_event_data_...
in few words, add to your props.conf
[your_sourcetype]
TRANSFORMS-null = setnull
and to your transforms.conf
[setnull]
REGEX = ^Audit\s+file\s+
DEST_KEY = queue
FORMAT = nullQueue
Ciao.
Giuseppe
Hello @gcusello , I just tried your answer and it is exactly what I needed, thank you very much brother, a big hug from the Dominican Republic.
Hi @zcx01067,
good for you, see next time!
please accept the answer for the other people of Community
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the Contributors 😉