Getting Data In

How to include medium-large texts with the events?

unitedmarsupial
Path Finder

I'm developing an inotify-based daemon to report core-dumps occasionally occurring in a directory.

Reporting the fact of the crash is easy, but we also want to include the debugger's output (showing the full stack at the time of crash).

Should I make that simply one large text-field (with multiple newlines):

{
    "PID": 1111,
    "stack": "#0  0x00000001 in ?? ()\n#1  0x28098e5f in xo_attr (name=0x5 <Address 0x5 out of bounds>, fmt=0x0) ...."
}

or a list of lines:

{
     "PID": 1111,
     "stack": [
        "#0  0x00000001 in ?? ()",
        "#1  0x28098e5f in xo_attr (name=0x5 <Address 0x5 out of bounds>, fmt=0x0)",
       ...
     ]
}

Are there technical pluses/minuses to either approach, or is it just a matter of taste? For example, would Splunk's additional tools (such as the Patterns-seeker) prefer one method over another?

0 Karma

PavelP
Motivator

you have to increase (or set to zero for this sourcetype) TRUNCATE in props.conf for the first example if the length can exceed 10000 bytes.

the probability that the regex find a wrong match is higher for a very long line (depends on your regex).

from the other side, Splunk best practices are to keep mulitline events to a minimum:
https://dev.splunk.com/enterprise/docs/developapps/logging/loggingbestpractices/#Keep-multi-line-eve...

0 Karma

to4kawa
SplunkTrust
SplunkTrust

props.conf

LINE_BREAKER = ([\r\n]+)|\\\n

and add SEDCMD

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!