Getting Data In

Why is event breaking working on the output of a script (input/file), but not on the script output itself (input/script)?

crash1011
Explorer

I have created a script below that will simulate exactly what I'm experiencing.

If I redirect the script's output to a file and monitor that with the following sourcetype in props.conf, it event breaks all OK.
If I use exactly the same sourcetype for the input/script everything works, however, I never get to see Fan 2!?
I've tried various types of LINE_BREAK/LINE MERGE/MAX_EVENTS to get it work with no success, although, I must have missed the magic combination...

props.conf

[macos:fanspeed]
PREAMBLE_REGEX = (Total fans in system:\s.)
BREAK_ONLY_BEFORE = ()Fan #[0|1|2]:
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = true
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
description = Extract fan speed
disabled = false

getFanSpeedSim.sh

cat <<EOF
Total fans in system: 3

Fan #0:
    Actual speed : 998
    Minimum speed: 1000
    Maximum speed: 4600
    Safe speed   : 0
    Target speed : 1000
    Mode         : auto

Fan #1:
    Actual speed : 1329
    Minimum speed: 1200
    Maximum speed: 5500
    Safe speed   : 0
    Target speed : 1200
    Mode         : auto

Fan #2:
    Actual speed : 1199
    Minimum speed: 1200
    Maximum speed: 3500
    Safe speed   : 0
    Target speed : 1200
    Mode         : auto
EOF

Thanks in advance!

0 Karma

jtrujillo
Path Finder

Why not just back it up to before the number? Or try a range?

BREAK_ONLY_BEFORE = ()Fan #:

-OR-

BREAK_ONLY_BEFORE = ()Fan #[0-3]:

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...