Getting Data In

How to configure line breaking on ADmanagerplus log?

wliu_ondeck
Explorer

I am working on ingesting ADmanagerplus logs. I am having difficulty linebreaking the following log which represents one event. How can I successfully configure this so splunk recognizes this as one event and not one event per line.

[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Contact Modification|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Task:Modify Single Group|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Object Name:GoofysStore|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Domain Name:acme.local|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Properties:|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: managedBy = CN=Acme,OU=Users,OU=US,DC=acme,DC=local|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Modification Status:Successfully Updated.|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************|
0 Karma
1 Solution

wliu_ondeck
Explorer

Found solution via regex. ^.*\[\d*\]: ((?![\*:=]).)*$

View solution in original post

0 Karma

wliu_ondeck
Explorer

Found solution via regex. ^.*\[\d*\]: ((?![\*:=]).)*$

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!