Getting Data In

Line breaking not working with rolling log files

Path Finder

Log file name : run_xxxxxxx_XXX_XXXXXX_XXX.log.04020830

This is the log file name and its suffix always ends with current date. So it gets rolled everyday into a new file with new date.
For this I have added crcSalt in inputs.conf file.

Pasted below is the log event format. Where "beginning" line is the start of event and "ending" line is the end of event. This is one complete event
23:30:05 =================/XXX/XXXXXX/run_XXX.ksh beginning=================
23:30:15 =================/XXX/XXXXXX/run_XXX.ksh ending====================

For this I have applied below parsing under props.conf of heavyforwarder
BREAK_ONLY_BEFORE = ^\d{1,2}:\d{1,2}:\d{1,3}\s.*\sbeginning

This parsing is working when I tested the same on local machine or test environment with single log file. But in production, since there it creates a rolling log file everyday, this line breaking is not working.

Please suggest?

Thanks in advance

0 Karma



Have you tried with this? I have just added *.

0 Karma

Path Finder

Hi @kamlesh_vaghela these pre-requisites/basic steps are already in place (although i missed that in description). What I am looking for here is that even after all those steps, breaking is not happening properly.
And I am doubting the cause behind it is rolling log file. So need to know if any specific step or variable is there to add for this rolling log file line parsing?

0 Karma

Path Finder

Any expert advice splunkers?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!