Getting Data In

How to merge all lines into one single event?

Hi,
How can I merge all lines of a config file into one single event?
My inputs.conf is:

[monitor:D:\CatTools3\Config.Current.Running.ASA-CLI.txt]
sourcetype = CatTools:Firewall:ASA-CLI
host_regex = Config.Current.Running.(?P.+)
index = eli

And my props.conf is:
[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = TRUE

But on Splunk search, each line is a single event, so now I have more than 5000 events instead of one event of 5000 lines.

0 Karma
1 Solution

Finally I solved by putting the following rows of my props.conf into the deployment server and also the index server:

[CatTools:Firewall:ASA-CLI]
SHOULDLINEMERGE = TRUE
LINE
BREAKER = (ALLROWSINTOONEEVENT)
DATETIMECONFIG = CURRENT
TRUNCATE = 0
MAX
EVENTS = 100000

View solution in original post

0 Karma

Finally I solved by putting the following rows of my props.conf into the deployment server and also the index server:

[CatTools:Firewall:ASA-CLI]
SHOULDLINEMERGE = TRUE
LINE
BREAKER = (ALLROWSINTOONEEVENT)
DATETIMECONFIG = CURRENT
TRUNCATE = 0
MAX
EVENTS = 100000

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@danielearangiomazza If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Contributor

Try this in props.conf:

[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE=gobbldegook
MAX_EVENTS=200000
LINE_BREAKER = ((*FAIL))
TRUNCATE=99999999

The break only before and line breaker above are set to something that should not match in the source file.
There is also a 500 line default for max events which we are bypassing above.
The result should be that the entire ASA config is imported as a single event.

0 Karma

Same as before, nothing change.

0 Karma

SplunkTrust
SplunkTrust

After modifying props.conf you must restart your indexer(s) for the change to take effect.
Changes to props.conf only apply to NEW data. Events already indexed will not change.

---
If this reply helps you, an upvote would be appreciated.

Done, same as before

0 Karma

SplunkTrust
SplunkTrust

How are you breaking events? The default setting is by line, even with line merging turned on.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

What do you mean? Where can i see this setting?

0 Karma

SplunkTrust
SplunkTrust

It will be in props.conf. If you have access to the CLI, run this command. It will show all of the properties for that sourcetype. Look for LINE_BREAKER, which is probably set to the default value of "([\r\n]+)". You should change the value in parentheses to something that separates one event from another.

splunk btool --debug props list CatTools:Firewall:ASA-CLI | more
---
If this reply helps you, an upvote would be appreciated.
0 Karma