Why does the Ping audit format break with props?

[ddrillic]

The audit file has this format -

# 18/Apr/2019:14:59:38.341 -0500; ....
dn: dc=....
changetype: modify
replace: ds-sync-state
ds-sync-state: .....

# 18/Apr/2019:15:01:32.404 -0500; ....
dn: uid=Testing123,....
changetype: delete

# 18/Apr/2019:15:01:33.352 -0500; ....
dn: dc=....
changetype: modify
replace: ds-sync-state
ds-sync-state: .....

In props.conf I have -

[ldap:....]
disabled=false
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\#\s+\S+
TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
TIME_PREFIX=^\#\s+
MAX_TIMESTAMP_LOOKAHEAD=50
TRUNCATE=10000

The parsing doesn't always work and I end up with events with multiple lines such as -

# 18/Apr/2019:14:59:38.341 -0500; ....

This line should be only the starting line of each event.

What am I missing?

[somesoni2 · Accepted solution]

Give this a try

[ldap:....]
 disabled=false
 SHOULD_LINEMERGE=false
 LINE_BREAKER=([\r\n]+)(?=\s*\#\s+\d+\/\w+)
 TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
 TIME_PREFIX=^\s*#\s+
 MAX_TIMESTAMP_LOOKAHEAD=30
 TRUNCATE=10000

[ddrillic]

Gorgeous @somesoni2 - what might have gone wrong with the original props set up? Does _internal capture incorrect set-ups, like my original one?

[somesoni2]

Main change I did was to update LINE_BREAKER to handle possible spaces before # in the raw data. Again, unless there is a syntax error, all regex are valid for Splunk and you'll not see any error (Splunk can't decide if you want to merge those events or not).

[ddrillic]

Perfect - makes sense.