Splunk Enterprise

Having issues with props.conf file: avoid line breaking after newline and carriage return

SIEMStudent
Path Finder

Hi Splunkers,

I'm on an addon creation task, Glassfish in particular and, like other times I faced tese kind or request, I'm configuring the props.conf file.

In this configuration I'm facing the following issue: I know that events starts with two kind of character sequences:

  1. [#|
  2. Date in format month (3 letters) and day, so for example Jun 07

So, in BREAK_ONLY_BEFORE, i putted the following regex: 

 

 

 [\[\#\|] | [\w{3}\s\d{2}]

 

 

 and it works fine.

A problem rise in the second case: when this events are present, they have a structure with many carriage return. Here a log sample:

 

 

Jun 07, 2022 8:29:52 PM <some_path_here>info
INFO: JVM invocation command line:
-XX:+UnlockDiagnosticVMOptions
-XX:MaxPermSize=<size>
-XX:PermSize=<size>
-XX:NewRatio=<size>
-Xms<size>
-Xmx4096m
<other lines that starts always with - symbol>

 

 

 In such case, the default event line breaking split every info in this events in a different events. So, I set 

 

 

SHOULD_LINEMERGE=1

 

 

but I have still problems; even with this configuration, the events are not properly merged. What I got are 3 different events splitted in such a way::

 

 

Jun 07, 2022 8:29:52 PM <some_path_here>info

 

 

first part of info starting with - symbol, so:

 

 

INFO: JVM invocation command line:
-XX:+UnlockDiagnosticVMOptions
-XX:MaxPermSize=<size>
-XX:PermSize=<size>
-XX:NewRatio=<size>
-Xms<size>
-Xmx4096m

 

 

remaining part of info starting with - symbol, so:

 

 

-Djavax.net.<remaining path>
-Dcom.sun.enterprise.security.httpsOutboundKeyAlias=<value>
-DANTLR_USE_DIRECT_CLASS_LOADING=<value>

 

 

To fix this, I tried to use:

 

 

MUST_NOT_BREAK_AFTER=[\r\n]+

 

 

but it does not work. The event is still divided in the above 3 different parts.

How can I fix it?

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this:

[<ST here>]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\n\r]+)(\[#\||\w+ \d\d, \d\d\d\d)
NO_BINARY_CHECK=true
TIME_FORMAT=%b %d, %Y %I:%M:%S %p
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=32

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this:

[<ST here>]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\n\r]+)(\[#\||\w+ \d\d, \d\d\d\d)
NO_BINARY_CHECK=true
TIME_FORMAT=%b %d, %Y %I:%M:%S %p
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=32

r. Ismo 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...