Getting Data In

Trouble splitting events correctly

nwenzl_splunk
Splunk Employee
Splunk Employee

Hello Splunkers,

I'm having trouble getting some weblogs to show up correctly in Splunk. What I'm trying to index looks like this:

201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4"&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)"

Every event is separated by &&& and so far I've managed the events to split somewhat correctly, but can't get rid of the &&& that still shows up at the beginning of each event:

201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4"

&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)"

props.conf:

LINE_BREAKER = (\d+)&&&(\d+)
NO_BINARY_CHECK = true
REPORT-access = access-extractions
SHOULD_LINEMERGE = false
TIME_PREFIX = \[
TRUNCATE = 0
category = Custom
disabled = false
maxDist = 28
pulldown_type = true

I've also tried using things like MUST_BREAK_AFTER = .+?(?=&&&) but that didn't help either.
Anybody who can offer any advice?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks lines at the first capture group discards the contents of that group. Try LINE_BREAKER = \d+(&&&)\d+.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks lines at the first capture group discards the contents of that group. Try LINE_BREAKER = \d+(&&&)\d+.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

nwenzl_splunk
Splunk Employee
Splunk Employee

Thanks for your answer, I had already figured it out in the meantime. LINE_BREAKER = (&&&)(\d+) worked.

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on