Multiline log

[rjyetter]

Hello,

I have a log that the customer wants to have parsed and put in to the dashboard. The log is pretty awkward and I'm not sure how to rex out the following:

Message Content (Buffer Size is 65536 bytes):
282 of 40000 Containers in use.
271 of 40000 Buffers in use.
8 Containers in use longer than 60.0 seconds.
Message Metadata (Buffer Size is 16384 bytes):
40 of 20000 Containers in use.
117 of 20000 Buffers in use.
0 Containers in use longer than 60.0 seconds.
Transaction Log (Buffer Size is 8192 bytes):
16 of 8192 Containers in use.

So there are 3 events in each log entry and multiple values for each event. What is the best way of doing this?

Thanks,

Rick

[kristian_kolb]

Are the 3 'sub-events' listed above always present in each event?
In that order?
Are they always the same (Message Content, Message Metadata, Transaction Log)?
Which values do you want to extract - just the 282, 271, 8, 40, 117, 0, 16? Or do you want Max values and buffer sizes etc as well?

/k

[sowings]

I would use SHOULD_LINEMERGE = true, treat the whole thing as one event, then you can rex it as a single multi-line event. Yeah, that's ugly, and your regex would be something like

Message\sContent.*(?<content_containers>\d+)\sof\s(?<content_containers_max>\d+)...

[rashid47010]

hi sowings

we recently integrate the aix servers with splunk.
when we see the audit logs in system itself it is showing the logs in two lines. and in splunk it only shows the first line.
how to fix that issue