Getting Data In

Why is event breaking working on the output of a script (input/file), but not on the script output itself (input/script)?

crash1011
Explorer

I have created a script below that will simulate exactly what I'm experiencing.

If I redirect the script's output to a file and monitor that with the following sourcetype in props.conf, it event breaks all OK.
If I use exactly the same sourcetype for the input/script everything works, however, I never get to see Fan 2!?
I've tried various types of LINE_BREAK/LINE MERGE/MAX_EVENTS to get it work with no success, although, I must have missed the magic combination...

props.conf

[macos:fanspeed]
PREAMBLE_REGEX = (Total fans in system:\s.)
BREAK_ONLY_BEFORE = ()Fan #[0|1|2]:
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = true
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
description = Extract fan speed
disabled = false

getFanSpeedSim.sh

cat <<EOF
Total fans in system: 3

Fan #0:
    Actual speed : 998
    Minimum speed: 1000
    Maximum speed: 4600
    Safe speed   : 0
    Target speed : 1000
    Mode         : auto

Fan #1:
    Actual speed : 1329
    Minimum speed: 1200
    Maximum speed: 5500
    Safe speed   : 0
    Target speed : 1200
    Mode         : auto

Fan #2:
    Actual speed : 1199
    Minimum speed: 1200
    Maximum speed: 3500
    Safe speed   : 0
    Target speed : 1200
    Mode         : auto
EOF

Thanks in advance!

0 Karma

jtrujillo
Path Finder

Why not just back it up to before the number? Or try a range?

BREAK_ONLY_BEFORE = ()Fan #:

-OR-

BREAK_ONLY_BEFORE = ()Fan #[0-3]:

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...