Getting Data In
Highlighted

Log4j events line-break not consistent

Communicator

I'm bringing in alfresco logs, in this case share.log and for the most part the events are broken up by line correctly

09:30:32,256 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]      Nothing to push to Solr

, until they're not

09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] 
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Processing 0 orphaned content
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]    Processing Deletes: 0
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]      Nothing to push to Solr
09:30:42,405 INFO  [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco-Solr Sync Alfresco Stats: Total Folders: 737; Total Documents: 44587
09:30:42,405 INFO  [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco-Solr Sync Solr Stats: Already In Solr: 44586; Created: 1; Updated: 0; Removed: 0; Orphaned: 0
09:30:42,413 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco To Solr Push Sync: Job finished

My props is thus:

[XXXXXX:uat:alfresco]
LINE_BREAKER = ([\r\n]+)
#BREAK_ONLY_BEFORE = \d\d?:\d\d:\d\d
pulldown_type = true
maxDist = 75
category = Application

Neither line breaker nor BREAKONLYBEFORE have worked on this correctly. What am I doing wrong? Thanks

0 Karma
Highlighted

Re: Log4j events line-break not consistent

SplunkTrust
SplunkTrust

What seems to be the problem? The line breaks look OK to me. Or is the second example a single event?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Log4j events line-break not consistent

Communicator

The second example shows as one event but it's 7 events in the log.

0 Karma
Highlighted

Re: Log4j events line-break not consistent

Esteemed Legend

You need to add this (defaults to true; keep everything else as you showed it:

SHOULD_LINEMERGE=false

View solution in original post

Highlighted

Re: Log4j events line-break not consistent

Communicator

No change, unfortunately.

0 Karma
Highlighted

Re: Log4j events line-break not consistent

Esteemed Legend

You have to restart splunk on all the indexers and it will only effect NEWLY INDEXED events.

0 Karma
Highlighted

Re: Log4j events line-break not consistent

Communicator

So this is not a search time property addition? Ok, thanks.

0 Karma
Highlighted

Re: Log4j events line-break not consistent

Esteemed Legend

That is correct.

0 Karma