Getting Data In

line-breaking question...

a212830
Champion

Hi,

I have a new multi-line feed that needs to be put into SPlunk, and it's one of the more challenging ones that I've run into.

The line will start with a number, followed by a colon ":", and then the word Bandwidth, followed by another colon. It could then have variables lines, and it ends with "Name:" and some value. Examples are below. The file also has other info, but I don't want that. Oh yeah, it's on Windows. No idea where to even start on this one (besides, Mad Men and GOT is on tv tonight!).

SubZone:
         1:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "SLC_SZ"
         2:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Canaada_SZ"
         3:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "SLC American Fork_SZ"
         4:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "UK_SZ"
         5:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Japan_SZ"
         6:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Hong Kong_SZ"
         7:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "Taiwan_SZ"
         8:
           Bandwidth:
             ClusterUsage: "0"
             LocalUsage: "0"
           Name: "India_SZ"
Tags (2)
0 Karma

linu1988
Champion

Hello,
You can use props.conf to manage that in indexer end.

BREAK_ONLY_BEFORE=\d:

will make sure the events break at only with a number and colon.

Thanks

a212830
Champion

Thanks. I'm also going to look at the SEDCMD, which allows me to run sed commands against the stream.

0 Karma

linu1988
Champion

Best option always will be setting the start or end. I see start is the better way. There is not much pattern to redirect the inputs to null queue. So better leave it that way. it will be very hard to filter lines inbetween your multi line event. If it solves the issue mark it as an answer...

0 Karma

a212830
Champion

Thanks. I got that working. Any suggestion on filtering out (or filtering in) in this type of situation? The event should start with a number, followed by a colon, and end with "Name:" and some value. Anything that doesn't meet that criteria should be filtered.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...