How to configure Splunk to break events after an empty line or before certain strings?

[dhavamanis]

We have the logs like below pattern. We want to break the events after an empty newline or starting before ERROR: or starting before TypeError:

Can you please tell us how to adjust this props.conf entry, seems this is not breaking based on empty newline,

[nodejs_stdout]
BREAK_ONLY_BEFORE = (^\n)|(^\r)|(^\n\r)|(^\r\n)|(^ERROR:)|(^TypeError:)
category = Custom
pulldown_type = true
TRUNCATE = 0

#######################################

> hydra-demo@0.3.27 start /opt/nbcuni/apps/hydra-chiller/app
> better-npm-run start "/opt/nbcuni/apps/hydra-chiller/app/"

running better-npm-run in /opt/nbcuni/apps/hydabcra-chiller/app
Executing script: start

to be executed: hydra start /opt/nbcuni/apps/hydra-chiller/app/
to be executed: ASSETS_PATH="/opt/nbcuni/apps/hydra-chiller/app/static" SERVER="/opt/nbcuni/apps/hydra-chiller/app/src/server.js" CLIENT="/opt/nbcuni/apps/hydra-chiller/app/src/client.js" NODE_PATH="/opt/nbcuni/apps/hydra-chiller/app:/opt/nbcuni/apps/hydra-chiller/app/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules:$NODE_PATH" ROOT_DIR="/opt/nbcuni/apps/hydra-chiller/app" npm run start

> hydra-dev@0.2.2 start /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev
> NODE_ENV=production node ./server.start.js

==> ð  Open http://localhost:3000 in a browser to view the app.
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesContextWrapper.js:23:19)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:100:28
    at flush (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/_microtask.js:18:9)
    at nextTickCallbackWith0Args (node.js:420:9)
ERROR: getRequest failed
{ timestamp: '2016-07-19T16:12:00.844+0000',
  status: 404,
  code: '100',
  message: '/content/media-gallery/ with (id = slasher-episode-1-behind-scenes-0) was not found',
  path: '/chillertv/content/media-gallery/slasher-episode-1-behind-scenes-0' }
undefined
 r
rlleryIndexctCompositeComponent.js.js:146:11lleryIndexlleryIndex.jsnnot read property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:153:16ntComponent
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesCastIndex.js:22:25)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:285:24)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
 r
rnnoictCompositeComponent.js reaCastIndeCastIndeCastIndex.js:82:24.componentWillMount.js property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:210:12ntComponent
bject Object].ReactCompositeComponentMixin.


####################################

[twinspop · Accepted solution]

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

[sundareshr]

Try this

[ nodejs_stdout ]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=([\n\r]|Type|ERROR)