Getting Data In

props.conf event breaks

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We have the following format of a log starting with the first message in the log as Status_AdvCorrServerSerial = 0 then the last line of the event as RawCaptureTimeStamp = #, which we set at the timestamp. After the event in the format below there are 2 spaces between each event then it goes into the same format again.

Status_AdvCorrServerSerial = 0
50 Some lines of material...
RawCaptureTimeStamp = 1373987459
-new line-
-new line-
Status_AdvCorrServerSerial = 0
50 Some lines of material...
RawCaptureTimeStamp = 1373987459

Here is our props.conf but it does not seem to properly break on all events:

[ncpmonitor]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial =
TIME_PREFIX=RawCaptureTimeStamp =

Is there something additional I should add to account for the 2 spaces between events or does this props.conf entry look alright?

Thanks!

Tags (3)
0 Karma

lguinn2
Legend

I would probably change the regexes a bit so that they are more flexible regarding the spacing:

[ncpmonitor]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial\s*=
TIME_PREFIX=RawCaptureTimeStamp\s*=\s*

Where exactly are the "spaces"? Are you talking about 2 blank lines between events or two spaces that sometimes appear at the beginning of the line with Status_AdvCorrServerSerial? Splunk should only break events at a line break when you are using BREAK_ONLY_BEFORE - it should break at the beginning of the line that matches.

lguinn2
Legend

You could also try

BREAK_ONLY_BEFORE=\s*Status_AdvCorrServerSerial\s*

It shouldn't make a difference, though.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Beat me to it. One other thing is you may need to specify TIME_FORMAT=%s for the epoch time stamp recognition.

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Thanks for your post. The two spaces are between events. Ill give this a shot

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.