Getting Data In

how to use source stanza in props.conf with spefic regex?

rajasekhar14
Path Finder

i'm trying yo use below source stanza in props.conf file to break the events.

my source pattern will be ""xxx/messeages or performance/345/345/xxxxx.blob"" can you guys please help with this PCRE?

after the regex i will use below settings
[source::]
sourcetype = Json
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = { messages

Thanks,
Raj

Tags (1)
0 Karma

jnudell_2
Builder

Hi @rajasekhar14 ,

It's not straight PCRE, it includes the path translations as specified in the props.conf documentation.
You could use something like:

[source::.../(messages|performance)/345/345/*.blob]
sourcetype = json
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+){\s*messages

I would recommend using SHOULD_LINEMERGE = false & LINE_BREAKER instead of BREAK_ONLY_BEFORE.


See if that works for you.

0 Karma

nplamondon
SplunkTrust
SplunkTrust

What have you tried? Where are you getting stuck?

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...