Getting Data In

How to write Linebreaker rule for the below events?

lksridhar
Explorer

Hi Team,

We have ingested the NSG flow logs from azure and few events are not breaking the events properly, could you please help me to write the LINE_BREAKER rule for below events.

Sample events:

"time":"2018-05-30T16:07:43.6682050Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","12000,T,O,A"]}]}]}{"time":"2018-05-30T16:06:43.6499999Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","resourceId":"/,T,O,A"]}]}]}{"time":"2018-05-30T16:06:43.6499999Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","resourceId":"/,T,O,A"]}]}]}

LINE_BREAKER=?

Tags (2)
0 Karma
1 Solution

@lksridhar, can you try with this?

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

dpetracca_splun
Splunk Employee
Splunk Employee

hey guys, sorry for making my comment an answer. For some reason, it won't allow me to make comments, only answers.... ???
When I click on "comment" it drops down to the main answers section.

0 Karma

dpetracca_splun
Splunk Employee
Splunk Employee

@niketnilay, no your 29 is correct, I wasn't looking at timezone. Was more focused on the line break actually.

lksridhar
Explorer

Thanks nikentilay and dpetracca for your input. i tried nikentilay command it is working for me.

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29

Thanks for helping to fix the issue.

dpetracca_splun
Splunk Employee
Splunk Employee

I came to same conclusion as @niketn-deceased
I tested it out and here is the props.conf that works:

[test_line_break]
DATETIME_CONFIG =
LINE_BREAKER = (]}]}]})
MAX_TIMESTAMP_LOOKAHEAD = 27
NO_BINARY_CHECK = true
TIME_PREFIX = time
category = Custom
disabled = false
pulldown_type = true

@dpetracca I had MAX_TIMESTAMP_LOOKAHEAD as 29 to extract even the timezone. Are you planning to apply TIMESTAMP_FORMAT %6N and stop Timestamp extraction?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Are you missing a curly bracket in the line 1??

0 Karma

@lksridhar, can you try with this?

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

@lksridhar, great to hear that your issue is resolved. I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...