Splunk not breaking events correctly

[shanleyj]

Hi

I'm forwarding logs into Splunk from a database trace file via monitor through a LWF.

Example file content is as follows:

Thu Sep 30 17:09:54 2010
Unix_process_pid=10218
LENGTH : '132'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/' 
PRIVILEGE :[6] 'SYSDBA'    
CLIENT USER:[6] 'oracle' 
CLIENT TERMINAL:[0] ''
STATUS:[1] '0'

The props.conf contains the following:

[db_audit]
TIME_FORMAT = %a %b %d %H:%M:%S %Y
BREAK_ONLY_BEFORE_DATE = true
SHOULD_LINEMERGE = true

For some reason Splunk is not consistently breaking on date. I have tried using a REGEX instead of breaking on date. I have also re-arranged so that the line "Unix_process_pid" is the start of the event. The same inconsistent behaviour remains. Around 90% are correctly broken into events and the remainder are truncated. Examples:

Event
Thu Sep 30 17:09:54 2010
Unix_process_pid=10218
LENGTH : '132'
ACTION :[7] 'CONNECT'


Event
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[0] ''
STATUS:[1] '0'

Splunk version is 4.1.1

[ziegfried]

I would suggest to use a LINE_BREAKER instead of line merging:

[db_audit]
TIME_FORMAT = %a %b %d %H:%M:%S %Y
SHOULD_LINEMERGE = false
LINE_BREAKER=([\r\n]+)\w+ \w+ \d{2} \d{2}:\d{2}:\d{2} \d{4}[\r\n]

And make sure the props.conf settings are on the indexer (when using an LWF).

[shanleyj]

Thanks for the reply.

Unfortunately I'm still getting the same result.

On further inspection the script which outputs the data to the file prints each line individually. So although it takes milliseconds it looks like Splunk's tail on the file is consuming the data before the entire event has been printed to the file.

I've just tried this out by manually adding data to the file and it is breaking at random points.

Not sure what to do with that one...