Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Line breaks and the 'Add Data' process
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Line breaks and the 'Add Data' process
I'm a fairly inexperience Splunk admin, and I've used the Add Data feature a couple of times to test out new sourcetype properties. At the moment, I'm trying to develop a custom syslog sourcetype and apply it to a network input but I'm having a lot of difficulty with line breaking. The sample data I'm using was gathered by a packet capture, exported as raw data, and added to a text file. It seem to get it working with the sample data, but when I apply it to the actual input, I run into all sorts of issues.
This got me thinking...the syslog events in the input stream do not actually end with a CR/LF character. But every event my sample data that I'm ingesting is on a new line. Is this an inaccurate way to represent the sample data? Would it be a more accurate representation of the input stream if I concatenated these test events onto a single line in my sample text file and tried to line-break from there?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The "right" way to do this is to use the Stream app for Splunk to do the packet capture and you will be blown away. Is there some reason that you cannot do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, just inexperience. I am reading the documentation now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have spent the last four hours trying to make sense of this app, but it is just way too far over my head at my current experience level. Hopefully someone will respond with an alternate approach.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You install the splunkstreamfwd.tgz app on your forwarder, set your ethernet adapter to promiscuous mode and you should have data coming in.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
