How can I break a multiline log by discarding the header and taking the rest?

[zcx01067]

Hello, I have a multiline log file, but each file comes with a header that I want to discard and only use the part of the log that brings the important information, can someone help me.

Here is the original log file:

Audit file /oracle/SIC/AUDIT/SYS_OPERATIONS/ora_1695798.aud
Oracle9i Enterprise Edition Release 9.2.0.8.0 - 64bit Production
With the Partitioning option
JServer Release 9.2.0.8.0 - Production
ORACLE_HOME = /oracle/SIC/920_64
System name: AIX
Node name: duero
Release: 3
Version: 5
Machine: 00CF214F4C00
Instance name: SIC
Redo thread mounted by this instance: 1
Oracle process number: 37
Unix process pid: 1695798, image: oracle@duero (TNS V1-V3)

Sat Mar 19 06:03:53 2022
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

Sat Mar 19 06:03:53 2022
ACTION : '/* BRARCHIVE */ CREATE PFILE = '/oracle/SIC/920_64/dbs/sap.ora' FROM SPFILE = '/oracle/SIC/920_64/dbs/spfileSIC.ora''
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

But I only need these parts of the log:

Sat Mar 19 06:03:53 2022
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

Sat Mar 19 06:03:53 2022
ACTION : '/* BRARCHIVE */ CREATE PFILE = '/oracle/SIC/920_64/dbs/sap.ora' FROM SPFILE = '/oracle/SIC/920_64/dbs/spfileSIC.ora''
DATABASE USER: '/'
PRIVILEGE : SYSOPER
CLIENT USER: orasic
CLIENT TERMINAL:
STATUS: 0

[PickleRick]

If I understand you correctly, the whole "header thing" is also a multiline "entity".

You could try setting proper event breaking, especially with BREAK_ONLY_BEFORE_DATE. That way you could check later as @gcusello showed and discard anything that - for example - doesn't start with a date.

[zcx01067]

Also for you thank you very much brother @PickleRick 

[gcusello]

Hi @zcx01067,

you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Filter_event_data_...

in few words, add to your props.conf

[your_sourcetype]
TRANSFORMS-null = setnull

and to your transforms.conf

[setnull]
REGEX = ^Audit\s+file\s+
DEST_KEY = queue
FORMAT = nullQueue

 Ciao.

Giuseppe

[zcx01067]

Hello @gcusello , I just tried your answer and it is exactly what I needed, thank you very much brother, a big hug from the Dominican Republic.

[gcusello]

Hi @zcx01067,

good for you, see next time!

please accept the answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉