Splunk Cloud Platform

LineBreaking Issue with AWS cloudwatch logs indestion

Nhari
New Member
Hi Everyone, Facing some issues with line breaking while ingeting aws cloudwatch logs using Splunk_TA_aws app. Any suggestions please
Tags (2)
0 Karma

shivanshu1593
Builder

A common trouble with JSON data. Can you share your some sample data? Please mask any sensitive data like IP addresses or anything related to your company, as its risky and usually leads to the question being deleted. If that's not possible, try modifying snd implementing something like this in your props.conf.

[Your_sourcetype]
KVMODE=json
LINEBREAKER= your_regex_to_identify_the_whitespace_between_closing_and_opening_braces_of_first_and_second_events
MAX
TIMESTAMPLOOKAHEAD=30
NO
BINARYCHECK=true
SHOULD
LINEMERGE=false

 

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...