Getting Data In

breaking lines before a regex

DrRandDumb
New Member

We have a tcp input that is merginging lines when they come in too fast.

I have (inputs)

[tcp://5140]
connection_host = dns
sourcetype=apigee
source=tcp:5140
index=apigee

I tried putting into props.conf the following info:

[apigee]
SHOULD_LINEMERGE = false

But this doesn't seem to work.

Is there a way to force this to always break on newlines - alternately, I could regex to break BEFORE the <11>?

here is an example that is munged:

<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSBASKETBALL, target_path=/api/me/sport/activities/NPLUSBASKETBALL, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 147, target_response_time = 52, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852510996, client_request_end_time_stamp = 1375852510997, target_request_start_time_stamp = 1375852511090, target_request_end_time_stamp = 1375852511090,  client_response_time_stamp = 1375852511143, client_response_end_time_stamp = 1375852511143, target_response_start_timestamp = 1375852511142, target_response_end_timestamp = 1375852511142
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/Running, target_path=/api/me/sport/activities/Running, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 200, total_response_time = 243, target_response_time = 93, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852514060, client_request_end_time_stamp = 1375852514061, target_request_start_time_stamp = 1375852514210, target_request_end_time_stamp = 1375852514210,  client_response_time_stamp = 1375852514303, client_response_end_time_stamp = 1375852514303, target_response_start_timestamp = 1375852514303, target_response_end_timestamp = 1375852514303
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSKINECTTRG, target_path=/api/me/sport/activities/NPLUSKINECTTRG, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 67, target_response_time = 28, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852516029, client_request_end_time_stamp = 1375852516029, target_request_start_time_stamp = 1375852516068, target_request_end_time_stamp = 1375852516068,  client_response_time_stamp = 1375852516096, client_response_end_time_stamp = 1375852516096, target_response_start_timestamp = 1375852516091, target_response_end_timestamp = 1375852516096
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSTRG, target_path=/api/me/sport/activities/NPLUSTRG, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 157, target_response_time = 69, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852518106, client_request_end_time_stamp = 1375852518107, target_request_start_time_stamp = 1375852518194, target_request_end_time_stamp = 1375852518194,  client_response_time_stamp = 1375852518263, client_response_end_time_stamp = 1375852518263, target_response_start_timestamp = 1375852518263, target_response_end_timestamp = 1375852518263
Tags (3)
0 Karma

davecroto
Splunk Employee
Splunk Employee

Create a props.conf stanza for the sourcetype that you want to use and add this stanza

alt text

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...