Getting Data In

How to merge all lines into one single event?

danielearangiom
Explorer

Hi,
How can I merge all lines of a config file into one single event?
My inputs.conf is:

[monitor:D:\CatTools3\Config.Current.Running.ASA-CLI.txt]
sourcetype = CatTools:Firewall:ASA-CLI
host_regex = Config.Current.Running.(?P.+)
index = eli

And my props.conf is:
[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = TRUE

But on Splunk search, each line is a single event, so now I have more than 5000 events instead of one event of 5000 lines.

0 Karma
1 Solution

danielearangiom
Explorer

Finally I solved by putting the following rows of my props.conf into the deployment server and also the index server:

[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = TRUE
LINE_BREAKER = (ALL_ROWS_INTO_ONE_EVENT)
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
MAX_EVENTS = 100000

View solution in original post

0 Karma

danielearangiom
Explorer

Finally I solved by putting the following rows of my props.conf into the deployment server and also the index server:

[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = TRUE
LINE_BREAKER = (ALL_ROWS_INTO_ONE_EVENT)
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
MAX_EVENTS = 100000

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@danielearangiomazza If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Lazarix
Communicator

Try this in props.conf:

[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE=gobbldegook
MAX_EVENTS=200000
LINE_BREAKER = ((*FAIL))
TRUNCATE=99999999

The break only before and line breaker above are set to something that should not match in the source file.
There is also a 500 line default for max events which we are bypassing above.
The result should be that the entire ASA config is imported as a single event.

0 Karma

danielearangiom
Explorer

Same as before, nothing change.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

After modifying props.conf you must restart your indexer(s) for the change to take effect.
Changes to props.conf only apply to NEW data. Events already indexed will not change.

---
If this reply helps you, an upvote would be appreciated.

danielearangiom
Explorer

Done, same as before

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are you breaking events? The default setting is by line, even with line merging turned on.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

danielearangiom
Explorer

What do you mean? Where can i see this setting?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It will be in props.conf. If you have access to the CLI, run this command. It will show all of the properties for that sourcetype. Look for LINE_BREAKER, which is probably set to the default value of "([\r\n]+)". You should change the value in parentheses to something that separates one event from another.

splunk btool --debug props list CatTools:Firewall:ASA-CLI | more
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.