Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Line Breaker help
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Guys,
I'm trying to ingest an entire html file as a single event everytime it gets written. The html file ALWAYS starts with ANGLEBRACKET p ANGLEBRACKET and always ends with ANGLEBRACKET p ANGLEBRACKET. Any suggestions about how to setup the line breaking?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on comments, I think this should work:
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)\<p\>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on comments, I think this should work:
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)\<p\>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just to make sure - it begins with <p> and ends with </p>, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks FrankVI for the response. Correct that it doesn't have html tags around it, however it can function perfectly fine without those tags. There are only "P" tags at the beginning and end. Question about your solution. This file gets over-written 4 times a day. would setting MAX_Events and Should_LineMERGE be sufficient to keep each file as a single event, but also create a new event each time the file gets over-written?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's a good question, never tried that.
But if there are indeed no further <p> elements inside the file, then you could just use that as a linebreaker.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which is odd, because that means it isn't a valid HTML file, as that should at least have <html> tags around it all, right?
Also important to know before being able to answer this: are there any further <p> tags in the middle of the file?
But since you don't want Splunk to break anything, wouldn't it be sufficient to just increase the MAX_EVENTS setting to larger than the expected number of lines and leave SHOULD_LINEMERGE to its default true value?
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
