Getting Data In

How do I configure line breaking for this text file?

DavidHourani
Super Champion

Hello Splunkers,

I'm having an issue with my event break. I have a huge text file with no line breaks that looks something like:

2016-02-08T12:25:21+01:00blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla 2016-02-08T12:25:21+01:00taablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla2016-02-08T12:25:21+01:00blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla2016-02-08T12:25:21+01:00blablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla

I tried using the BREAK_ONLY_BEFORE setting and other settings to break my event, but nothing works. Any ideas how I can break this?

Regards,
David

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this.. Make sure you put this stanza in your props.conf on the indexer and restart your Splunk service after adding this

[SOURCE]
 SHOULD_LINEMERGE=true
 BREAK_ONLY_BEFORE = \d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\+\d{2}
0 Karma

DavidHourani
Super Champion

I did, it doesn't work. im using GUI for import and events aren't getting split no matter what i do.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Is there a space between the text and the timestamp in your logs?

0 Karma

DavidHourani
Super Champion

yeap whitespace right before the timestamps..its all in one huge block.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I'm confused. There appears to be a space before some of the timestamps but in others there is no space before the timestamp, regex wouldn't pick this up as it doesn't fit a pattern.

This should work and if not, then I would suggest modifying your log files so it includes a space

BREAK_ONLY_BEFORE = \d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\+\d{2}\:\d{2}
0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...