Splunk Cloud Platform

LineBreaking Issue with AWS cloudwatch logs indestion

Nhari
New Member
Hi Everyone, Facing some issues with line breaking while ingeting aws cloudwatch logs using Splunk_TA_aws app. Any suggestions please
Tags (2)
0 Karma

shivanshu1593
Builder

A common trouble with JSON data. Can you share your some sample data? Please mask any sensitive data like IP addresses or anything related to your company, as its risky and usually leads to the question being deleted. If that's not possible, try modifying snd implementing something like this in your props.conf.

[Your_sourcetype]
KVMODE=json
LINEBREAKER= your_regex_to_identify_the_whitespace_between_closing_and_opening_braces_of_first_and_second_events
MAX
TIMESTAMPLOOKAHEAD=30
NO
BINARYCHECK=true
SHOULD
LINEMERGE=false

 

 

Thank you,
Shiv

****If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues****
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>