Splunk Search
Highlighted

How to configure Splunk to break events after an empty line or before certain strings?

Builder

We have the logs like below pattern. We want to break the events after an empty newline or starting before ERROR: or starting before TypeError:

Can you please tell us how to adjust this props.conf entry, seems this is not breaking based on empty newline,

[nodejs_stdout]
BREAK_ONLY_BEFORE = (^\n)|(^\r)|(^\n\r)|(^\r\n)|(^ERROR:)|(^TypeError:)
category = Custom
pulldown_type = true
TRUNCATE = 0

#######################################

> hydra-demo@0.3.27 start /opt/nbcuni/apps/hydra-chiller/app
> better-npm-run start "/opt/nbcuni/apps/hydra-chiller/app/"

running better-npm-run in /opt/nbcuni/apps/hydabcra-chiller/app
Executing script: start

to be executed: hydra start /opt/nbcuni/apps/hydra-chiller/app/
to be executed: ASSETS_PATH="/opt/nbcuni/apps/hydra-chiller/app/static" SERVER="/opt/nbcuni/apps/hydra-chiller/app/src/server.js" CLIENT="/opt/nbcuni/apps/hydra-chiller/app/src/client.js" NODE_PATH="/opt/nbcuni/apps/hydra-chiller/app:/opt/nbcuni/apps/hydra-chiller/app/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules:$NODE_PATH" ROOT_DIR="/opt/nbcuni/apps/hydra-chiller/app" npm run start

> hydra-dev@0.2.2 start /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev
> NODE_ENV=production node ./server.start.js

==> ð  Open http://localhost:3000 in a browser to view the app.
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesContextWrapper.js:23:19)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:100:28
    at flush (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/_microtask.js:18:9)
    at nextTickCallbackWith0Args (node.js:420:9)
ERROR: getRequest failed
{ timestamp: '2016-07-19T16:12:00.844+0000',
  status: 404,
  code: '100',
  message: '/content/media-gallery/ with (id = slasher-episode-1-behind-scenes-0) was not found',
  path: '/chillertv/content/media-gallery/slasher-episode-1-behind-scenes-0' }
undefined
 r
rlleryIndexctCompositeComponent.js.js:146:11lleryIndexlleryIndex.jsnnot read property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:153:16ntComponent
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesCastIndex.js:22:25)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:285:24)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
 r
rnnoictCompositeComponent.js reaCastIndeCastIndeCastIndex.js:82:24.componentWillMount.js property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:210:12ntComponent
bject Object].ReactCompositeComponentMixin.


####################################
0 Karma
Highlighted

Re: How to configure Splunk to break events after an empty line or before certain strings?

Legend

Try this

[ nodejs_stdout ]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=([\n\r]|Type|ERROR)
0 Karma
Highlighted

Re: How to configure Splunk to break events after an empty line or before certain strings?

Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

View solution in original post