Getting Data In

How to combine two consecutive lines into a single event using the upload file option in "Add Data"?

jeck11
Path Finder

I have been searching through the thousands of results I've gotten on this topic but they all seem to be more advanced than what I'm looking for.

Here is an example from the data:

2017-02-22T18:00:54 <HOST>            | Creating request for https://0.0.20.20/ (www.company.com) Company VIP Site 2
2017-02-22T18:00:54 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 VIP; URL: https://0.0.20.20/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.30/ (www.company.com) Company VIP Site 1
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 1; URL: https://0.0.20.30/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.40/ (www.company.ca) Company VIP Site 2 CA
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 CA VIP; URL: https://0.0.20.40/; Domain: www.company.ca; Expiration: 08/10/2018 08:00:00
2017-02-22T18:01:02 <HOST>            | Creating request for https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/ (smetrics.company.com) Omniture Metrics US VIP
2017-02-22T18:01:02 <WARNING>         | Error SSL1406 - A certificate was not evaluated for the web request.; Data: Omniture Metrics US VIP; URL: https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/; Domain: smetrics.company.com
2017-02-22T18:01:06 <HOST>            | Creating request for https://0.0.20.50:8080/ (sec-comp-axm) RSA Access Manager Site 2 VIP
2017-02-22T18:01:06 <ERROR>           | Error SSL1404 - The SSL policy returned an error.; Data: RemoteCertificateNameMismatch RSA Access Manager Site 2 VIP; URL: https://0.0.20.50:8080/; Domain: sec-comp-axm; Expiration: 09/29/2018 15:46:00

I'm trying to use the "Add Data" option to upload the file. I need each entry that's broken out to contain two rows. The first is the target and the second would be the result. It doesn't seem like this should be that hard... what am I missing?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...