Getting Data In

Why does the file without line feeds and carriage does not run?

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I have a file without CR al LF to divide events.
I usually parsed these files without problems (e.g. SAP logs), but now I don't know why it doesn't run!
this is an example of my file

141.146.8.66 - - [13/Jan/2016 21:03:09:200] "POST /category.screen?category_id=SURPRISE&JSESSIONID=SD1SL2FF5ADFF3 HTTP 1.1" 200 3496 "http://www.myflowershop.com/cart.do?action=view&itemId=EST-16&product_id=RP-SN-01" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4" 294&&&130.253.37.97 - - [13/Jan/2016 21:03:09:185] "GET /category.screen?category_id=BOUQUETS&JSESSIONID=SD7SL2FF1ADFF8 HTTP 1.1" 200 2320 "http://www.myflowershop.com/cart.do?action=changequantity&itemId=EST-12&product_id=AV-CB-01" "Opera/9.20 (Windows NT 6.0; U; en)" 361&&&141.146.8.66 - - [13/Jan/2016 21:03:09:167] "GET /product.screen?product_id=RP-LI-02&JSESSIONID=SD9SL9FF8ADFF1 HTTP 1.1" 200 3855 "http://www.myflowershop.com/cart.do?action=changequantity&itemId=EST-20&product_id=RP-LI-02" "Googlebot/2.1 ( http://www.googlebot.com/bot.html) " 929&&&

The end of an event is &&& .
I tried with SHOULD_LINEMERGE = true and false
I tried with LINE_BREAKING, MUST_BREAK_AFTER, BREAK_ONLY_BEFORE_DATE and BREAK_ONLY_BEFORE.
I tried to replace &&& with \n , but every time I continue to have only one event not divided.
Where I'm wrong? i know that it's a very stupid thing but I'm going mad!

Thank you in advance.

Bye.
Giuseppe

0 Karma
1 Solution

niketn
Legend

@cusello did you try LINE_BREAKING or LINE_BREAKER? Following setting works fine for me:

LINE_BREAKER=(&&&)

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@cusello did you try LINE_BREAKING or LINE_BREAKER? Following setting works fine for me:

LINE_BREAKER=(&&&)

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gcusello
SplunkTrust
SplunkTrust

Fantastic, as always!
but, only to understand: why must I use parenthesis?
Bye.
Giuseppe

0 Karma

niketn
Legend

Anytime!!! Paranthesis makes it capturing group. 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...