Splunk Search

Difficulty with linemerge and break_only

cwwirth
Explorer

I'm trying to get the following lines, all in the same text file on a Windows server, to show up as a single event in Splunk:

11/25/2013  12:00:10 PM     Engine version                          =   5600.1067
11/25/2013  12:00:10 PM     AntiVirus   DAT version                 =   7271.0
11/25/2013  12:00:10 PM     Number of detection signatures in EXTRA.DAT =   None
11/25/2013  12:00:10 PM     Names of detection signatures in EXTRA.DAT  =   None
11/25/2013  12:00:10 PM Scan Started    DOMAIN\PRINTING$    (managed) Server Full scan
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Scan Summary
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Processes scanned    : 49
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Processes detected   : 0
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Processes cleaned    : 0\

On the source server, I have an inputs.conf stanza calling out that file as its own sourcetype:

[monitor://c:\ProgramData\McAfee\DesktopProtection\OnDemandScanLog.txt]
sourcetype = McAfeeOnDemandScan

And on the indexer, I have a stanza in props.conf to (try) to merge these all into one event, breaking at the first line ("Engine" appears only in the first line in the file):

[McAfeeOnDemandScan]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = Engine

...yet each line still appears as its own event. Would anyone be so kind as to point me in the right direction?

Thanks!

Tags (1)
0 Karma
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

This props.conf stanza worked great for me using your data sample:

[McAfeeOnDemandScan]
BREAK_ONLY_BEFORE=^\d+/\d+/\d+\s+\d+:\d+:\d+\s+Engine
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

View solution in original post

0 Karma

emechler_splunk
Splunk Employee
Splunk Employee

This props.conf stanza worked great for me using your data sample:

[McAfeeOnDemandScan]
BREAK_ONLY_BEFORE=^\d+/\d+/\d+\s+\d+:\d+:\d+\s+Engine
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

0 Karma

cwwirth
Explorer

Yep, that works great for me too. Thanks!

0 Karma

aelliott
Motivator

if they all start with a date and "engine version" you could potentially set it up to break only before a regex of the date and word Engine

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...