Getting Data In

Splunkforwarder pushes multiple lines as single event from windows machine logs

mayurkale471757
Explorer

Hi Team, I came across an issue where I have below sample logs in a file 

15:30:31.396|Info|Response ErrorMessage: ||
15:30:36.610|Info|Logging Rest Client Request...||
15:30:36.610|Info|Request Uri: https://abc-domain/api/xy/Identify||
15:30:36.694|Info|Logging Rest Client Response...||
15:30:36.694|Info|Response Status Code: 401||
15:30:36.710|Info|Response Status Description: Unauthorized||
15:30:36.741|Info|Response Content: ||
15:30:36.741|Info|Response ErrorMessage: ||
15:30:36.762|Info|Logging Rest Client Request...||

I am using splunk forwarder version splunkforwarder-8.2.4-87e2dda940d1-x64-release

with below prop.conf settings

 

[xyz:mnl]
LB_CHUNK_BREAKER = ([\r\n]+)

 

 

On splunk portal I am not getting one line as a one event instead I am getting multiple lines as a single event like below 

 

mayurkale471757_1-1701261344829.png

 

 

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mayurkale471757 ,

try to upload a sample of your file using the Add Data GUI feature that guides you in the sourcetype creation.

Ciao.

Giuseppe

View solution in original post

mayurkale471757
Explorer

Thanks Guys, changing the settings at HF solved this issue

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mayurkale471757 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

gcusello
SplunkTrust
SplunkTrust

Hi @mayurkale471757 ,

try to upload a sample of your file using the Add Data GUI feature that guides you in the sourcetype creation.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...