Getting Data In

Merge lines from rotated file



I have some difficulties to ingest properly logs from rotated file, where the rotation is fully handled by an application, without any settings about its log files.

In some cases, it rotates the log file in the middle of an event, and before the timestamp.

Like this:





Note: there is no new line or carriage return at tne end of the file





I have some events with an additional line in plain text (no brackets), so at first I let the line merger do its job, but for the splitted line between the 2 log files, it does not work as the first line does not contain the timestamp, and it is added to the previous event.

So, I disabled line merging and started to build a line breaker, resulting in this:


This is because the log line is made of 25 blocks between brackets, and optionally a second line.

It works very good on a test file when the splitted line is in the same file, but once the 2 parts of the line are in different files ... it does not work anymore 😞

Do you have any advice on how I could handle that ?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...