Getting Data In

How to combine two consecutive lines into a single event using the upload file option in "Add Data"?

jeck11
Path Finder

I have been searching through the thousands of results I've gotten on this topic but they all seem to be more advanced than what I'm looking for.

Here is an example from the data:

2017-02-22T18:00:54 <HOST>            | Creating request for https://0.0.20.20/ (www.company.com) Company VIP Site 2
2017-02-22T18:00:54 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 VIP; URL: https://0.0.20.20/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.30/ (www.company.com) Company VIP Site 1
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 1; URL: https://0.0.20.30/; Domain: www.company.com; Expiration: 08/10/2018 08:00:00
2017-02-22T18:00:56 <HOST>            | Creating request for https://0.0.20.40/ (www.company.ca) Company VIP Site 2 CA
2017-02-22T18:00:56 <HOST>            | Information SSL1399 - The certificate is valid.; Data: Company VIP Site 2 CA VIP; URL: https://0.0.20.40/; Domain: www.company.ca; Expiration: 08/10/2018 08:00:00
2017-02-22T18:01:02 <HOST>            | Creating request for https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/ (smetrics.company.com) Omniture Metrics US VIP
2017-02-22T18:01:02 <WARNING>         | Error SSL1406 - A certificate was not evaluated for the web request.; Data: Omniture Metrics US VIP; URL: https://smetrics.company.com/b/ss/company-us-prod,company-r2-worldwide-prod/1/H.19.3/; Domain: smetrics.company.com
2017-02-22T18:01:06 <HOST>            | Creating request for https://0.0.20.50:8080/ (sec-comp-axm) RSA Access Manager Site 2 VIP
2017-02-22T18:01:06 <ERROR>           | Error SSL1404 - The SSL policy returned an error.; Data: RemoteCertificateNameMismatch RSA Access Manager Site 2 VIP; URL: https://0.0.20.50:8080/; Domain: sec-comp-axm; Expiration: 09/29/2018 15:46:00

I'm trying to use the "Add Data" option to upload the file. I need each entry that's broken out to contain two rows. The first is the target and the second would be the result. It doesn't seem like this should be that hard... what am I missing?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Looks to me like this will work, based on your sample:

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\|\s+Creating request for
CHARSET=UTF-8
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...