Events are coming across as 1 event

[dbcase]

Hi,

I have the below data and Splunk is importing it as 1 event instead of two. The break should be on "Premise". How can I have Splunk import this correctly?

"Premise"="1001169" "Type"="doorLock" "SensorId"="002446fffd0005a9.2 " "Label"="910 - 5 Button A" "Manufacturer"="Kwikset" "Model"="SMARTCODE_DEADBOLT_5" "Firmware version"="0x3071cb06" "Hardware version"="3" "UserProperty.batteryLow"="true" "UserProperty.NearEndRssi"="-24" "UserProperty.NearEndLqi"="255" "UserProperty.label"="910 - 5 Button A" "FE radio"="NA/NA" "NE radio"="-24/255" "Date added"="Thu Mar 20 10:44:09 EDT 2014" "Date of last communication"="Thu Jun 01 13:55:20 EDT 2017" "In Communication Failure"="true" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Is Locked"="false"
"Premise"="1001169" "Type"="doorLock" "SensorId"="000d6f00024c646b.1 " "Label"="Yale Door Lock" "Manufacturer"="Yale" "Model"="YRD220/240 TSDB" "Firmware version"="0x00840850" "Hardware version"="17" "UserProperty.batteryLow"="false" "UserProperty.NearEndRssi"="-31" "UserProperty.NearEndLqi"="255" "UserProperty.label"="Yale Door Lock" "Battery Operated"="True" "Voltage"="N/A" "FE radio"="NA/NA" "NE radio"="-31/255" "Date added"="Thu Jun 05 15:26:39 EDT 2014" "Date of last communication"="Mon Jun 05 15:48:43 EDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Is Locked"="true" "Max Users"="250" "Operation Mode"="normal"

[somesoni2 · Accepted solution]

You would need to setup event parsing configuration (props.conf) on your Indexer/heavy forwarder. (check which field contains the timestamp, you would need to adjust the TIME_PREFIX accordingly)

props.conf

[yoursourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\"Premise\"\=)
TIME_PREFIX = \"Date added\"\=\"\w+
TIME_FORMAT = %b %d %H:%M:%S %Z %Y
MAX_TIMESTAMP_LOOKAHEAD =24

[dbcase]

Hmmm, probably should have mentioned this before hand..... I'm using Splunk Cloud so no access to props.conf that I'm aware of.

[somesoni2]

How are you ingesting data? directly from your search head? OR using some UF to get data into your Splunk?

[dbcase]

right now, using the web gui just to test. Eventually it will be a UF.

[somesoni2]

You can define the sourcetype when testing from UI (on Select Sourcetype page, in advanced tab on the left, use the settings that I suggested). When it's rolled to production, you would need to work with your Splunk admin/Splunk Cloud admins to get that configs available in Indexers/Heavy forwarders.