Getting Data In

Trouble splitting events correctly

nwenzl_splunk
Splunk Employee
Splunk Employee

Hello Splunkers,

I'm having trouble getting some weblogs to show up correctly in Splunk. What I'm trying to index looks like this:

201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4"&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)"

Every event is separated by &&& and so far I've managed the events to split somewhat correctly, but can't get rid of the &&& that still shows up at the beginning of each event:

201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4"

&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)"

props.conf:

LINE_BREAKER = (\d+)&&&(\d+)
NO_BINARY_CHECK = true
REPORT-access = access-extractions
SHOULD_LINEMERGE = false
TIME_PREFIX = \[
TRUNCATE = 0
category = Custom
disabled = false
maxDist = 28
pulldown_type = true

I've also tried using things like MUST_BREAK_AFTER = .+?(?=&&&) but that didn't help either.
Anybody who can offer any advice?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks lines at the first capture group discards the contents of that group. Try LINE_BREAKER = \d+(&&&)\d+.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks lines at the first capture group discards the contents of that group. Try LINE_BREAKER = \d+(&&&)\d+.

---
If this reply helps you, Karma would be appreciated.
0 Karma

nwenzl_splunk
Splunk Employee
Splunk Employee

Thanks for your answer, I had already figured it out in the meantime. LINE_BREAKER = (&&&)(\d+) worked.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...