Getting Data In

How to combine two consecutive lines into a single event using the upload file option in "Add Data"?

jeck11
Path Finder

I have been searching through the thousands of results I've gotten on this topic but they all seem to be more advanced than what I'm looking for.

Here is an example from the data:

2017-02-22T18:00:54 <HOST>            | Creating request for https://0.0.20.20/ (www.company.com) Company VIP Site 2
2017-02-22T18:00:54 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 VIP; URL: https://0.0.20.20/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.30/ (www.company.com) Company VIP Site 1
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 1; URL: https://0.0.20.30/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.40/ (www.company.ca) Company VIP Site 2 CA
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 CA VIP; URL: https://0.0.20.40/; Domain: www.company.ca; Expiration: 08/10/2018 08:00:00
2017-02-22T18:01:02 <HOST>            | Creating request for https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/ (smetrics.company.com) Omniture Metrics US VIP
2017-02-22T18:01:02 <WARNING>         | Error SSL1406 - A certificate was not evaluated for the web request.; Data: Omniture Metrics US VIP; URL: https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/; Domain: smetrics.company.com
2017-02-22T18:01:06 <HOST>            | Creating request for https://0.0.20.50:8080/ (sec-comp-axm) RSA Access Manager Site 2 VIP
2017-02-22T18:01:06 <ERROR>           | Error SSL1404 - The SSL policy returned an error.; Data: RemoteCertificateNameMismatch RSA Access Manager Site 2 VIP; URL: https://0.0.20.50:8080/; Domain: sec-comp-axm; Expiration: 09/29/2018 15:46:00

I'm trying to use the "Add Data" option to upload the file. I need each entry that's broken out to contain two rows. The first is the target and the second would be the result. It doesn't seem like this should be that hard... what am I missing?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...