Getting Data In

How to configure line breaker?

sgarcia
Explorer

Hola comunidad 

I'm trying to configure the props file so that the following event starts from the third line:

sgarcia_0-1676491362546.png

Currently, I am testing as follows:

sgarcia_1-1676491426647.png

 

If I leave this setting, the timestamp of the first few lines will be taken from splunk, but it should take the timestamp of the lines with date.

Regards

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sgarcia,

you have to filter the first three rows using something l.ike this:

in props.conf:

[yoursourceytpe]
SHOULD_LINEMERGE = false
TRANSFORMS-removeheaderevent = setnull

in transforms.conf:

[setnull]
REGEX = ^(REPORTESDEBIT|TotalMovimientos|Id;Usuario)
DEST_KEY = queue
FORMAT = nullQueue

Please, next time, put the log samples in the Code/Sample box instead using a printscreen so we can use it to answer.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sgarcia,

you have to filter the first three rows using something l.ike this:

in props.conf:

[yoursourceytpe]
SHOULD_LINEMERGE = false
TRANSFORMS-removeheaderevent = setnull

in transforms.conf:

[setnull]
REGEX = ^(REPORTESDEBIT|TotalMovimientos|Id;Usuario)
DEST_KEY = queue
FORMAT = nullQueue

Please, next time, put the log samples in the Code/Sample box instead using a printscreen so we can use it to answer.

Ciao.

Giuseppe

sgarcia
Explorer

REPORTESDEBITACORAGRAL;;;;;;;;;;
TotalMovimientos:;;;;;;;;;;
ID;Usuario;Fecha/Horadecaptura;Tipodeoperacion;Clave;Emisor;Receptor;MediodeEntrega;Importe;Estado;TipodeError
1675816017182;DKXMMHA;07/Feb/202318:26hrs.;Logout;FinSesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675815710949;DKXMMHA;07/Feb/202318:21hrs.;Login;Ini.SesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814586855;SPEI;07/Feb/202318:03hrs.;AvisoTraspasoOK;2035;Sindefinicion;Sindefinicion;Sindefinicion;30,430,522.05;OK;
1675814481168;SPEI;07/Feb/202318:01hrs.;Act.delCat.Ins.;EnsesionInstituciones.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814481200;SPEI;07/Feb/202318:01hrs.;Act.delCat.Cert.;EnsesionCertificados.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814481231;SPEI;07/Feb/202318:01hrs.;Act.delCat.Nvls.;EnsesionNiveles.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sgarcia,

please try this regex:

^(REPORTESDEBITACORAGRAL|TotalMovimientos|ID;Usuario)

that you can test at https://regex101.com/r/0m8hng/1

Ciao.

Giuseppe

sgarcia
Explorer

Thank you, i try the configuration, and comeback as soon .

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...