Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: want to have Mutiline log file as single event...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My log goes like this. I want all contents between "BeginEvent" and "EndEvent" as a single event. Any help?
Will greatly appreciate it
--------BeginEvent--------
04/09/2012 09:28:34 EventStartTime=Mon Apr 09 09:28:34 PDT 2012
04/09/2012 09:28:34 EventClass=TEST
04/09/2012 09:28:34 StatusCode=23
04/09/2012 09:28:34 ServerClassName=KSED
04/09/2012 09:28:34 EventData=Testing
---------EndEvent---------
--------BeginEvent--------
04/09/2012 11:38:10 EventStartTime=Mon Apr 09 11:38:10 PDT 2012>
04/09/2012 11:38:10 SessID=52352525252>
...
...
.....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your log files actually contains the '--------BeginEvent-------' string, you could have the following props.conf setting;
[your_sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+-+BeginEvent-+)
This should remove the 'BeginEvent' line altogether and break for the next event.
UPDATE:
No, it's far more efficient to use LINE_BREAKER than MUST_BREAK_BEFORE, MUST_NOT_BREAK_AFTER etc. This requires that SHOULD_LINEMERGE is set to false.
The incoming stream is then broken into events wherever the LINE_BREAKER regex matches.
I guess that you could craft a regex that could remove the 'EndEvent' line as well, though I have not tried it. It could possibly look like (though this is a bit beyond my regex skills)
LINE_BREAKER = (?m)(([\r\n]+-+EndEvent-+)?[\r\n]+-+BeginEvent-+)
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your log files actually contains the '--------BeginEvent-------' string, you could have the following props.conf setting;
[your_sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+-+BeginEvent-+)
This should remove the 'BeginEvent' line altogether and break for the next event.
UPDATE:
No, it's far more efficient to use LINE_BREAKER than MUST_BREAK_BEFORE, MUST_NOT_BREAK_AFTER etc. This requires that SHOULD_LINEMERGE is set to false.
The incoming stream is then broken into events wherever the LINE_BREAKER regex matches.
I guess that you could craft a regex that could remove the 'EndEvent' line as well, though I have not tried it. It could possibly look like (though this is a bit beyond my regex skills)
LINE_BREAKER = (?m)(([\r\n]+-+EndEvent-+)?[\r\n]+-+BeginEvent-+)
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
haha, tell my wife!
/k
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you are just awesome
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Kristian,
"04/09/2012 09:28:34 EventStartTime=Mon Apr 09 09:28:34 PDT 2012" , "04/09/2012 09:28:34 EventClass=TEST" etc....are actually in different lines (/n/r is present). Should i not set SHOULD_LINEMERGE to true?
Splunk Mobile: Your Brand-New Home Screen
Introducing Value Insights (Beta): Understand the Business Impact your organization ...
Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...
