Splunk Cloud

LineBreaking Issue with AWS cloudwatch logs indestion

Nhari
New Member
Hi Everyone, Facing some issues with line breaking while ingeting aws cloudwatch logs using Splunk_TA_aws app. Any suggestions please
Tags (2)
0 Karma

shivanshu1593
Contributor

A common trouble with JSON data. Can you share your some sample data? Please mask any sensitive data like IP addresses or anything related to your company, as its risky and usually leads to the question being deleted. If that's not possible, try modifying snd implementing something like this in your props.conf.

[Your_sourcetype]
KVMODE=json
LINEBREAKER= your_regex_to_identify_the_whitespace_between_closing_and_opening_braces_of_first_and_second_events
MAX
TIMESTAMPLOOKAHEAD=30
NO
BINARYCHECK=true
SHOULD
LINEMERGE=false

 

 

0 Karma