Getting Data In

Line breaking not working with rolling log files

Path Finder

Log file name : run_xxxxxxx_XXX_XXXXXX_XXX.log.04020830

This is the log file name and its suffix always ends with current date. So it gets rolled everyday into a new file with new date.
For this I have added crcSalt in inputs.conf file.

Pasted below is the log event format. Where "beginning" line is the start of event and "ending" line is the end of event. This is one complete event
23:30:05 =================/XXX/XXXXXX/run_XXX.ksh beginning=================
**
23:30:15 =================/XXX/XXXXXX/run_XXX.ksh ending====================

For this I have applied below parsing under props.conf of heavyforwarder
[source::/XXX/XXXXXX/XXX/XXX/.log.]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{1,2}:\d{1,2}:\d{1,3}\s.*\sbeginning

This parsing is working when I tested the same on local machine or test environment with single log file. But in production, since there it creates a rolling log file everyday, this line breaking is not working.

Please suggest?

Thanks in advance

0 Karma

SplunkTrust
SplunkTrust

@kundanbisht

Have you tried with this? I have just added *.

[source::/XXX/XXXXXX/XXX/XXX/.log.*]
0 Karma

Path Finder

Hi @kamlesh_vaghela these pre-requisites/basic steps are already in place (although i missed that in description). What I am looking for here is that even after all those steps, breaking is not happening properly.
And I am doubting the cause behind it is rolling log file. So need to know if any specific step or variable is there to add for this rolling log file line parsing?

0 Karma

Path Finder

Any expert advice splunkers?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!