line-breaking question...

[a212830]

Hi,

I have a new multi-line feed that needs to be put into SPlunk, and it's one of the more challenging ones that I've run into.

The line will start with a number, followed by a colon ":", and then the word Bandwidth, followed by another colon. It could then have variables lines, and it ends with "Name:" and some value. Examples are below. The file also has other info, but I don't want that. Oh yeah, it's on Windows. No idea where to even start on this one (besides, Mad Men and GOT is on tv tonight!).

SubZone:
         1:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "SLC_SZ"
         2:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Canaada_SZ"
         3:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "SLC American Fork_SZ"
         4:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "UK_SZ"
         5:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Japan_SZ"
         6:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Hong Kong_SZ"
         7:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Taiwan_SZ"
         8:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "India_SZ"

[linu1988]

Hello,
You can use props.conf to manage that in indexer end.

BREAK_ONLY_BEFORE=\d:

will make sure the events break at only with a number and colon.

Thanks

[a212830]

Thanks. I'm also going to look at the SEDCMD, which allows me to run sed commands against the stream.

[linu1988]

Best option always will be setting the start or end. I see start is the better way. There is not much pattern to redirect the inputs to null queue. So better leave it that way. it will be very hard to filter lines inbetween your multi line event. If it solves the issue mark it as an answer...

[a212830]

Thanks. I got that working. Any suggestion on filtering out (or filtering in) in this type of situation? The event should start with a number, followed by a colon, and end with "Name:" and some value. Anything that doesn't meet that criteria should be filtered.