Getting Data In

Splunkforwarder pushes multiple lines as single event from windows machine logs

mayurkale471757
Explorer

Hi Team, I came across an issue where I have below sample logs in a file 

15:30:31.396|Info|Response ErrorMessage: ||
15:30:36.610|Info|Logging Rest Client Request...||
15:30:36.610|Info|Request Uri: https://abc-domain/api/xy/Identify||
15:30:36.694|Info|Logging Rest Client Response...||
15:30:36.694|Info|Response Status Code: 401||
15:30:36.710|Info|Response Status Description: Unauthorized||
15:30:36.741|Info|Response Content: ||
15:30:36.741|Info|Response ErrorMessage: ||
15:30:36.762|Info|Logging Rest Client Request...||

I am using splunk forwarder version splunkforwarder-8.2.4-87e2dda940d1-x64-release

with below prop.conf settings

 

[xyz:mnl]
LB_CHUNK_BREAKER = ([\r\n]+)

 

 

On splunk portal I am not getting one line as a one event instead I am getting multiple lines as a single event like below 

 

mayurkale471757_1-1701261344829.png

 

 

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mayurkale471757 ,

try to upload a sample of your file using the Add Data GUI feature that guides you in the sourcetype creation.

Ciao.

Giuseppe

View solution in original post

mayurkale471757
Explorer

Thanks Guys, changing the settings at HF solved this issue

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mayurkale471757 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

gcusello
SplunkTrust
SplunkTrust

Hi @mayurkale471757 ,

try to upload a sample of your file using the Add Data GUI feature that guides you in the sourcetype creation.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...