Getting nth line of a file

[bleinfelder]

Hi there,

I'm trying to monitor the output of a batch job with splunk. The problem is that logging is poorly implemented and I need some sophisticated splunk (?) to meet my requirements.

The job writes errors to a log file. Together with the error message it states the line of the input file where the error occured. The input file can be splunked as well.

To be able to handle the error the guys in business department need the error message as well as the corresponding line in the input file.

I can extract the message with the line number from the job's log file.

How can I extract the correct line from the input file?

So far I tried to parse each line of the input file as a different event and getting the nth one using streamstats. Unfortunately the result stream doesnt maintain the correct order of the lines.

Any ideas about how I could extract the nth line of the file?

Regards,

Bernd

[martin_mueller]

You can select a specific line from an event like this:

sourcetype=input_file
| eval lines = _raw | makemv tokenizer="(.+)" lines
| eval error_line = mvindex(lines, [stats count | eval line_number = 4 | return $line_number])

I'm assuming your input file is indexed as one large event. The tokenizer turns the copy of _raw into a multivalue field, with each entry corresponding to one line. mvindex then accesses the line you need, as calculated by the subsearch that returns the line number from your error message.

[bleinfelder]

thank you, this works perfect!

[richgalloway]

When you say "the input file can be splunked as well" does that mean you have control over how it is ingested? If so, include the line number as a field with each line of input. Then you can easily associate the log entry with the input line.

[somesoni2]

sample logs please.