Splunk Search

How to configure Splunk to break events after an empty line or before certain strings?

dhavamanis
Builder

We have the logs like below pattern. We want to break the events after an empty newline or starting before ERROR: or starting before TypeError:

Can you please tell us how to adjust this props.conf entry, seems this is not breaking based on empty newline,

[nodejs_stdout]
BREAK_ONLY_BEFORE = (^\n)|(^\r)|(^\n\r)|(^\r\n)|(^ERROR:)|(^TypeError:)
category = Custom
pulldown_type = true
TRUNCATE = 0

#######################################

> hydra-demo@0.3.27 start /opt/nbcuni/apps/hydra-chiller/app
> better-npm-run start "/opt/nbcuni/apps/hydra-chiller/app/"

running better-npm-run in /opt/nbcuni/apps/hydabcra-chiller/app
Executing script: start

to be executed: hydra start /opt/nbcuni/apps/hydra-chiller/app/
to be executed: ASSETS_PATH="/opt/nbcuni/apps/hydra-chiller/app/static" SERVER="/opt/nbcuni/apps/hydra-chiller/app/src/server.js" CLIENT="/opt/nbcuni/apps/hydra-chiller/app/src/client.js" NODE_PATH="/opt/nbcuni/apps/hydra-chiller/app:/opt/nbcuni/apps/hydra-chiller/app/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules:$NODE_PATH" ROOT_DIR="/opt/nbcuni/apps/hydra-chiller/app" npm run start

> hydra-dev@0.2.2 start /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev
> NODE_ENV=production node ./server.start.js

==> ð  Open http://localhost:3000 in a browser to view the app.
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesContextWrapper.js:23:19)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:100:28
    at flush (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/_microtask.js:18:9)
    at nextTickCallbackWith0Args (node.js:420:9)
ERROR: getRequest failed
{ timestamp: '2016-07-19T16:12:00.844+0000',
  status: 404,
  code: '100',
  message: '/content/media-gallery/ with (id = slasher-episode-1-behind-scenes-0) was not found',
  path: '/chillertv/content/media-gallery/slasher-episode-1-behind-scenes-0' }
undefined
 r
rlleryIndexctCompositeComponent.js.js:146:11lleryIndexlleryIndex.jsnnot read property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:153:16ntComponent
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesCastIndex.js:22:25)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:285:24)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
 r
rnnoictCompositeComponent.js reaCastIndeCastIndeCastIndex.js:82:24.componentWillMount.js property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:210:12ntComponent
bject Object].ReactCompositeComponentMixin.


####################################
0 Karma
1 Solution

twinspop
Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

View solution in original post

twinspop
Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

sundareshr
Legend

Try this

[ nodejs_stdout ]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=([\n\r]|Type|ERROR)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...