Getting Data In

Line Breaks

JDukeSplunk
Builder

I need a working line-breaker for this sourcetype .I could muck about trying to get this working on my own, or I could ask here since it seems pretty simple. All of the events end with "Message()"

Here's the raw scrubbed raw event and a screencap of how Splunk is picking it up.

Jun 4 12:25:34 10.111.111.111 [0x80c0003f][AlereSSOSPDebug][info] xmlfirewall(SSOAuditLogFW): trans(11111111)[request][10.111.1.11] gtid(111111111X1111xx11x1xxxx):
Jun 4 12:25:34 10.214.8.104 Timestamp(2018-06-04T12:25:34-04:00)
Jun 4 12:25:34 10.214.8.104 ::
Jun 4 12:25:34 10.214.8.104 TransactionID(XXX-11111111)
Jun 4 12:25:34 10.214.8.104 ::
Jun 4 12:25:34 10.214.8.104 ClientId(HealthxX 1111111)
Jun 4 12:25:34 10.214.8.104 ::
Jun 4 12:25:34 10.214.8.104 UserInfo()
Jun 4 12:25:34 10.214.8.104 ::
Jun 4 12:25:34 10.214.8.104 Status(0x00000000)
Jun 4 12:25:34 10.214.8.104 ::
Jun 4 12:25:34 10.214.8.104 TimeTaken(V1_208_202_0_0_6)
Jun 4 12:25:34 10.214.8.104 ::
Jun 4 12:25:34 10.214.8.104 Message()

alt text

0 Karma
1 Solution

sshelly_splunk
Splunk Employee
Splunk Employee

Use the following in props.conf for the sourcetype:
"SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Message()$"

I tried w/your event data, and it worked for me.

View solution in original post

0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

Use the following in props.conf for the sourcetype:
"SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Message()$"

I tried w/your event data, and it worked for me.

0 Karma

JDukeSplunk
Builder

Yours worked in 99% of the events. What I finally ended up with was a really long regex.

BREAK_ONLY_BEFORE = \w{3}\s\d{1,2}\s\d{1,2}\:\d{1,2}\:\d{1,2}\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\[
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...