Splunk Search

Break into multiple events by time

rbonetti
Engager

Hi all,

I would like to break a line in multiple events in my log files, you can see the break condition in bold:

[10:27:21.937] DEBUG [RequestStatusTask] [c.s.t.p.a.c.d.p.PrinterWrapper] [onSequenceStatusChanged:758] printer 1 :Sequence State : READY / READY [10:27:22.500] DEBUG [AskCodeTask] [c.s.t.p.a.c.d.p.PrinterWrapper] [onPrinterBufferChanged:743] printer 1 :onPrinterBufferChanged, buffer status: LOW

Here is my props.conf, but it's not working:

[client_log]
BREAK_ONLY_BEFORE = [\d\d:\d\d:\d\d.\d\d\d]

Thanks for your help

Tags (1)

Ayn
Legend

Two things:

First, the BREAK_ONLY_BEFORE directive is used in the line merging process - that is, given a number of lines, it tells (optionally in conjunction with other parameters) how Splunk should merge these lines into one event. So, the definition of what a line IS happens earlier, using the LINE_BREAKER directive. Your log looks a bit odd to me in that the events aren't broken up into individual lines already. Before starting to mess with LINE_BREAKER you might want to investigate if the log itself can't be changed to actually separate events properly into individual lines.

Second, the [ and ] characters are special characters in regular expressions, so whatever regex you end up with will need to escape those.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...