Getting Data In

splunk not parsing txt file from forwarder correctly

bcusick
Communicator

Hi,

One of my forwarders is monitoring a directory where timestamped files populate every five minutes. The text output in the file includes a few-line header from the script along with all the results. The results are in the format "user ~ message"

For some reason, splunk is reading the ENTIRE file (source) as one log event. This is what's in my inputs file:

[monitor://D:\badPwdCount\logs\HIGH*.txt]

sourcetype = OVD_PW

disabled = false

SHOULD_LINEMERGE= false

crcSalt =

SOURCE is in between <> for crcSALT but it won't show up in comments. The issue is that Splunk is either picking up the entire file as an event, or a few events at a time as 1 event. Is a separate timestamp/unique identifier required for each line?

0 Karma
1 Solution

bcusick
Communicator

I added a field to the log records for "line number" which is basically "log record" and this worked like a charm. 🙂

View solution in original post

bcusick
Communicator

I added a field to the log records for "line number" which is basically "log record" and this worked like a charm. 🙂

ofrachon
Path Finder

You should tell Splunk how an event looks like in order to split the events correctly.

Could you post a sample of your data ?

0 Karma

lguinn2
Legend

SHOULD_LINEMERGE= false does not go in inputs.conf - it goes in props.conf like so

[OVD_PW]
SHOULD_LINEMERGE= false

I think that is the problem here.

martin_mueller
SplunkTrust
SplunkTrust

What settings are you using for that sourcetype in props.conf on the indexer(s)?
Additionally, do post some sample data.

0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...