Getting Data In

Line breaking : problem with blank lines ?

DavidCaputo
Explorer

Hi experts,
I'm collecting logs wich look like this :


2019-12-18_09:51:42.982 [] [req-] INFO ParGideBS.getByCle bulletinDispatch.timeout 0ms
2019-12-18_09:51:42.983 [] [req-] INFO ParGideBS.getByCle bulletinDispatch.timeout 0ms
2019-12-18_09:51:42.984 [] [req-] INFO AttributionBullBS.findAllBullDispatchD1EtD2 bulletinDispatch.timeout 1ms
2019-12-18_09:51:42.985 [] [req-] INFO AttributionBullBS.findAllBullDispatchDiv bulletinDispatch.timeout 1ms
2019-12-18_09:51:42.987 [] [req-] INFO AttributionBullBS.findAllBullDispatchCtrl bulletinDispatch.timeout 1ms

2019-12-18_09:51:42.981 [] [req-] INFO ParGideBS.getByCle bulletinDispatch.timeout 1ms

2019-12-18_09:51:32.557 [] [req-] INFO ParamGideBS.getByCle bulletinDispatch.timeout 0ms
2019-12-18_09:51:32.557 [] [req-] INFO ParamGideBS.getByCle bulletinDispatch.timeout 0ms
2019-12-18_09:51:32.558 [] [req-] INFO AttributionBullBS.findAllBullDispatchD1EtD2 bulletinDispatch.timeout 0ms
2019-12-18_09:51:32.559 [] [req-] INFO AttributionBullBS.findAllBullDispatchDiv bulletinDispatch.timeout 0ms

2019-12-18_09:51:32.560 [] [req-] INFO AttributionBullBS.findAllBullDispatchCtrl bulletinDispatch.timeout 0ms

With this file, I'd like splunk to do a very simple thing : create 1 event for each line, but... I can't do it.

I tried these parameters in props.conf :
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE_DATE = true
TIME_FORMAT=%Y-%m-%d_%H:%M:%S.%3N
TIME_PREFIX=^

or even :
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

or :
BREAK_ONLY_BEFORE = ^

All these parameters work well when I test the file using the "add data" feature in Splunk web...
BUT... it doesn't work when I push the prop.conf file in my production environment.

In the example above, Splunk merge the 5th first lines in 1 event, then I have one line in an event and the last 5 lines in another event : it seems that Splunk organize the parsing with the blank lines in the file (= lines between 2 blank line are grouped in the same event).

Could someone help me on this case and provided the "magic" props to solve it ?
Many thanks

David

0 Karma
1 Solution

DavidCaputo
Explorer

Problem solved :

I declared in my props.conf [sourcetype_name ] and it seems that the problem was the space after the sourcetype name.
with [sourcetype_name], the parameters above work perfectly.

Sorry for that stupid mistake !
David

View solution in original post

0 Karma

DavidCaputo
Explorer

Problem solved :

I declared in my props.conf [sourcetype_name ] and it seems that the problem was the space after the sourcetype name.
with [sourcetype_name], the parameters above work perfectly.

Sorry for that stupid mistake !
David

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...