Installation

How can I break down an event

ninisimonishvil
Path Finder

I have an input from app - WEB Input

It extracts last 5 events from webpage every 1 minute. however instead of spitting them into 5 Splunk sees it as 1 event :

განცხადებების სტატუსების ბოლო 5 ცვლილება მიმდინარეობს ხელშეკრულების მომზადება 07.02.2018 16:01 NAT180000701 შემსყიდველი: შპს ,,ბათუმის წყალი\" კატეგორია: 44100000 არ შედგა 07.02.2018 16:01 NAT180001544 შემსყიდველი: ახალციხის მუნიციპალიტეტის მერია კატეგორია: 50100000 გამარჯვებული გამოვლენილია 07.02.2018 16:00 NAT180000701 შემსყიდველი: შპს ,,ბათუმის წყალი\" კატეგორია: 44100000 შერჩევა/შეფასება 07.02.2018 16:00 NAT180000701 შემსყიდველი: შპს ,,ბათუმის წყალი\" კატეგორია: 44100000 წინადადებების მიღება დასრულებულია 07.02.2018 16:00 NAT180001544 შემსყიდველი: ახალციხის მუნიციპალიტეტის მერია კატეგორია: 50100000"

every event starts with date and ends with space followed by 8 consecutive numbers.

I tried to use SHOULD_MERGE and MUST_BREAK AFTER \s\d{8}
Also tried BREAK_ONLY_BEFORE \d{2}[.]\d{2}[.]\d{4} \d{2}:\d{2}

However getting no results.

0 Karma
1 Solution

Yunagi
Communicator

Have a look at Configure event line breaking.

Event line breaking consists of two steps: 1st) line breaking and 2nd) line merging.

Line breaking is mostly configured by LINE_BREAKER. By default, LINE_BREAKER is the newline character.

Line merging is configured by SHOULD_LINEMERGE=true and a couple of other options like BREAK_ONLY_BEFORE_DATE.

You should be concerned with line breaking. I suggest you try something like this:

LINE_BREAKER = ( \d{8})

View solution in original post

0 Karma

Yunagi
Communicator

Have a look at Configure event line breaking.

Event line breaking consists of two steps: 1st) line breaking and 2nd) line merging.

Line breaking is mostly configured by LINE_BREAKER. By default, LINE_BREAKER is the newline character.

Line merging is configured by SHOULD_LINEMERGE=true and a couple of other options like BREAK_ONLY_BEFORE_DATE.

You should be concerned with line breaking. I suggest you try something like this:

LINE_BREAKER = ( \d{8})
0 Karma

ninisimonishvil
Path Finder

Tried that too. Still no result.

0 Karma

Yunagi
Communicator

Are you running a single instance of Splunk? Or do you have multiple insances? This configuration (via props.conf) needs to be placed on the instance where the indexing phase happens. That could be a heavy forwarder.

Set SHOULD_LINEMERGE=false (along with the LINE_BREAKER option) and see if that makes a difference.

0 Karma

ninisimonishvil
Path Finder

It is a single instance yes and props.conf needs to be placed in application's local folder, since its the application that takes data from website.

0 Karma

Yunagi
Communicator

Try it like this:

[yoursourcetype]
LINE_BREAKER = ( )\d\d\.\d\d\.\d\d\d\d \d\d:\d\d

As you can see it should work: screenshot
(I autotranslated your input file.)

If it still does not work, can you post your props.conf? I would like to see the relevant stanza.

Also, don't forget to restart Splunk after editing configuration files.

0 Karma

ninisimonishvil
Path Finder

worked. thanks a lot!

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...