Getting Data In

splunk not parsing txt file from forwarder correctly

bcusick
Communicator

Hi,

One of my forwarders is monitoring a directory where timestamped files populate every five minutes. The text output in the file includes a few-line header from the script along with all the results. The results are in the format "user ~ message"

For some reason, splunk is reading the ENTIRE file (source) as one log event. This is what's in my inputs file:

[monitor://D:\badPwdCount\logs\HIGH*.txt]

sourcetype = OVD_PW

disabled = false

SHOULD_LINEMERGE= false

crcSalt =

SOURCE is in between <> for crcSALT but it won't show up in comments. The issue is that Splunk is either picking up the entire file as an event, or a few events at a time as 1 event. Is a separate timestamp/unique identifier required for each line?

0 Karma
1 Solution

bcusick
Communicator

I added a field to the log records for "line number" which is basically "log record" and this worked like a charm. 🙂

View solution in original post

bcusick
Communicator

I added a field to the log records for "line number" which is basically "log record" and this worked like a charm. 🙂

ofrachon
Path Finder

You should tell Splunk how an event looks like in order to split the events correctly.

Could you post a sample of your data ?

0 Karma

lguinn2
Legend

SHOULD_LINEMERGE= false does not go in inputs.conf - it goes in props.conf like so

[OVD_PW]
SHOULD_LINEMERGE= false

I think that is the problem here.

martin_mueller
SplunkTrust
SplunkTrust

What settings are you using for that sourcetype in props.conf on the indexer(s)?
Additionally, do post some sample data.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...