Getting Data In

Scripted Input Multiline Event wanted

hypePG
Path Finder

Hey,

I got a script which is executing a vmstat command on a host. Since yesterday I received the output in a single multiline event:

memTotalMB   memFreeMB   memUsedMB  memFreePct  memUsedPct   pgPageOut  swapUsedPct   pgSwapOut   cSwitches  interrupts       forks   processes     threads  loadAvg1mi  waitThreads    interrupts_PS    pgPageIn_PS    pgPageOut_PS
     50284       11822       38461        23.5        76.5  8730068031         25.6    23270004  2386506467  3085994601    95621910         274     1779        1.38        0.00      
2586.57         72.36        520.60

Since a few days the data is coming in in two parts. Header and Data like this:

    1   2/19/18
10:48:44.000 AM 
     50284       14795       35489        29.4        70.6  9031516273         34.8    24020729  4048038777   392164802    98916588         276        1813        1.51        0.00       4607.00         54.55       1477.27

    2   2/19/18
10:48:44.000 AM 
memTotalMB   memFreeMB   memUsedMB  memFreePct  memUsedPct   pgPageOut  swapUsedPct   pgSwapOut   cSwitches  interrupts       forks   processes     threads  loadAvg1mi  waitThreads    interrupts_PS    pgPageIn_PS    pgPageOut_PS

I didn't change any configuration at all. In the second case I can't use the multikv command becuase the headers for the fields are missing.

How can I fix this?

Regards,

Max

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

Hi

you probably need to configure EVENT BREAKER to avoid breaking your event in pieces before getting to indexers

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...