how to split a log file which contain multiple KPI information as many individual events using the delimiter "==========="?

[senthamilselvan]

[Pra] KPI_DB_001: Transactions per sec

Detailed breakdown of processing time % Total

***********************************************
Total processing 100 14566023932

Section execution

TOTAL_SECTION_PROC_TIME 3 575697340

TOTAL_SECTION_SORT_PROC_TIME 0 3809

[Pra] KPI_DB_005 Buffer pool hit ratio.

Type Ratio Formula

---

Data 9 (1-(16829502+6813417-15031035)/(3417808829+576
Index 99 (1-(4308509+1968-191493)/(6726500833+356522))

================================================================================

[Pra] KPI_DB_007

Per activity                    Total                                      (micro sec or nano sec ?)                  

LOCK_WAIT_TIME 0 2131581

LOCK_WAITS 0 547

================================================================================

[Pra] KPI_DB_006

Row processing
ROWS_READ/ROWS_RETURNED = 3325 (292223944055/87871120)

================================================================================

i want each kpi as individual event while importing my log file, please help me 🙂

[gcusello]

HI senthamilselvanj,
did you tried to insert in your props.conf something like the following configuration?

[ your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\[Pra\]\s+KPI

Bye.
Giuseppe

[senthamilselvan]

Hi Giuseppe,

Thank you for the replay, I tried but the syntax is not working as expected. Please find the below detailed info.
The below is my sample log files. All the information will come as single log file and i want to breaks this as separate events based on the delimiter "=====" . which is coming along with the log file.

Monitoring report - database summary

Database: DQA01CDW

Generated: 08/16/2017 11:03:38

Interval monitored: 900

Transactions per sec
ACT_COMPLETED_TOTAL 2760Pra 2484587[Pra] TPS cumulative value for last 900 sec

Component times

-- Detailed breakdown of processing time --

                                  %                 Total                     
                                  ----------------  --------------------------

Total processing 100 14566023932

Buffer pool hit ratio. This KPI is captured based on type, we can include Data, Index, XDA, COL. Formula is nice to have
Buffer pool

---

Buffer pool hit ratios

Type Ratio Formula

---

Data 9Pra (1-(16829502+6813417-15031035)/(3417808829+576

I tried using the below props.config file to split the logs
[dbmonitoring]
BREAK_ONLY_BEFORE = [=]+
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
category = Application
pulldown_type = true

But still events are not separated as expected based on delimiter.

Thanks
selvan