Splunk Search

How to configure an event line break?

beqanaveriani
New Member

I have syslog file like this:

Mar 21 06:48:23 10.171.134.200  Mar 21 08:10:00 10.171.134.200  AlteonOS : 1.1.1.34 26681 1.1.1.102 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.110 80 0.0.0.0 5441 |1.1.1.100 46324 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 60829 |1.1.1.100 46323 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 49779 |1.1.1.100 46322 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 55355 |1.1.1.100 46321 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 37147 |1.1.1.100 46320 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 9743 |1.1.1.100 46319 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 60972 |1.1.1.100 46318 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 44457 |1.1.1.100 46317 1.1.1.103 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.115 80 0.0.0.0 52215 |1.1.1.34 26680 1.1.1.102 443 tcp 21/03/2018-08:09:59 21/03/2018-08:09:59 2.2.2.110 80 0.0.0.0 10162 
Mar 21 06:48:23 10.171.134.200  Mar 21 08:09:59 10.171.134.200  AlteonOS : 1.1.1.100 46314 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 7436 |1.1.1.100 46313 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 60428 |1.1.1.100 46312 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 55927 |1.1.1.100 46311 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 55250 |1.1.1.34 26679 1.1.1.102 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.110 80 0.0.0.0 6404 |1.1.1.100 46310 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 52121 |1.1.1.100 46309 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 60205 |1.1.1.100 46308 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 2239 |1.1.1.100 46307 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 37096 |1.1.1.100 46306 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 9676 |1.1.1.100 46305 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 60016 |1.1.1.100 46304 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 62337 |
Mar 21 06:48:22 10.171.134.200  Mar 21 08:09:59 10.171.134.200  AlteonOS : 1.1.1.34 26678 1.1.1.102 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.110 80 0.0.0.0 6848 |1.1.1.100 46303 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 4597 |1.1.1.100 46302 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 12532 |1.1.1.100 46301 1.1.1.103 443 tcp 21/03/2018-08:09:58 21/03/2018-08:09:58 2.2.2.115 80 0.0.0.0 58217 |
Mar 21 06:48:38 10.171.134.200  Mar 21 08:10:15 10.171.134.200  AlteonOS : 1.1.1.29 7650 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 48035|
Mar 21 06:48:27 10.171.134.200  Mar 21 08:10:04 10.171.134.200  AlteonOS : 1.1.1.32 1220 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 7810 |1.1.1.39 2930 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 2916 |
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:02 10.171.134.200  AlteonOS : 1.1.1.39 2929 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 8556 |1.1.1.11 62222 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 50485 |
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:02 10.171.134.200  AlteonOS : 1.1.1.33 9718 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 6737 |1.1.1.13 42366 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 50042 |
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:02 10.171.134.200  AlteonOS : 1.1.1.35 32622 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 7853 |1.1.1.45 45192 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 5948 |
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.45 45191 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 12616 
|1.1.1.44 16547 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 8349 
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.38 55516 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.109 80 0.0.0.0 7102 |1.1.1.15 47625 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 46497 |1.1.1.37 65010 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 6115 |
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.37 65009 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 9520 |1.1.1.50 30630 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 11038 |
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.28 11837 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 47177 |1.1.1.14 55058 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 50269 |1.1.1.36 53419 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 6383|
Mar 21 06:48:25 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.36 53418 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.109 80 0.0.0.0 12390 
|1.1.1.49 10624 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 8155 |
Mar 21 06:48:24 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.25 12699 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 50753 |1.1.1.46 62300 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:58 2.2.2.109 80 0.0.0.0 5147 |1.1.1.46 62299 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.109 80 0.0.0.0 2821 |
Mar 21 06:48:24 10.171.134.200  Mar 21 08:10:01 10.171.134.200  AlteonOS : 1.1.1.24 62900 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 48378 |1.1.1.100 46300 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 43181 |1.1.1.100 46299 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 45601 |1.1.1.100 46298 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 49273 |1.1.1.100 46297 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 59934 |1.1.1.100 46296 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 61130 |1.1.1.34 26677 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 11909 |1.1.1.100 46295 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 13359 |1.1.1.100 46294 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 58119 |
Mar 21 06:48:21 10.171.134.200  Mar 21 08:09:58 10.171.134.200  AlteonOS : 1.1.1.100 46293 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 56647 |1.1.1.100 46292 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 55303 |1.1.1.100 46291 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 59869 |1.1.1.100 46290 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 55833 |1.1.1.100 46289 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 56617 |1.1.1.34 26676 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 7157 |1.1.1.100 46288 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 50858 |1.1.1.100 46287 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 2643 |1.1.1.100 46286 1.1.1.103 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.115 80 0.0.0.0 15662 |1.1.1.21 11980 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.109 80 0.0.0.0 48940 |1.1.1.22 30943 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 48283 |
Mar 21 06:48:20 10.171.134.200  Mar 21 08:09:57 10.171.134.200  AlteonOS : 1.1.1.44 16545 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 5491 |1.1.1.49 10623 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 11212 |1.1.1.32 1219 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 9480 |1.1.1.50 30629 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.109 80 0.0.0.0 11855 |1.1.1.35 32621 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 4721 |1.1.1.47 15935 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 14164 |1.1.1.23 7556 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 49126 |
Mar 21 06:48:20 10.171.134.200  Mar 21 08:09:57 10.171.134.200  AlteonOS : 1.1.1.45 45190 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 8525 |1.1.1.48 16483 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 8163 |1.1.1.46 62298 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.110 80 0.0.0.0 12537 |1.1.1.33 9717 1.1.1.102 443 tcp 21/03/2018-08:09:57 21/03/2018-08:09:57 2.2.2.109 80 0.0.0.0 8451 |1.1.1.100 46285 1.1.1.103 443 tcp 21/03/2018-08:09:56 21/03/2018-08:09:56 2.2.2.115 80 0.0.0.0 50886 |
Mar 21 06:48:20 10.171.134.200  Mar 21 08:09:57 10.171.134.200  AlteonOS : 1.1.1.49 10622 1.1.1.102 443 tcp 21/03/2018-08:09:56 21/03/2018-08:09:56 2.2.2.109 80 0.0.0.0 11531 |1.1.1.32 1218 1.1.1.102 443 tcp 21/03/2018-08:09:56 21/03/2018-08:09:56 2.2.2.109 80 0.0.0.0 8539 |1.1.1.32 1217 1.1.1.102 443 tcp 21/03/2018-08:09:56 21/03/2018-08:09:56 2.2.2.109 80 0.0.0.0 10906 

Result looks like this:

alt text

And I want it to be like this:

alt text

I don't know what to do.

0 Karma

pruthvikrishnap
Contributor

I am not sure what your requirement is, but if you want it to break as per the screen shot mentioned use this in props.conf

[index_name]
 LINE_BREAKER = \|\d+\.\d+\.\d+\.\d+\s\d+
SHOULD_LINEMERGE = false
0 Karma

FrankVl
Ultra Champion

That’s not correct. Firstly your linebreaker is missing the mandatory capturing group, secondly it doesn’t break at the actual event start, just the sessions.
The correct answer was already given in this comment: https://answers.splunk.com/comments/642783/view.html

0 Karma

ssadanala1
Contributor
0 Karma

FrankVl
Ultra Champion

He isn't looking for breaking it line by line, he wants to further break up the session data inside each line.

I guess technically, you could do this with a line breaker that breaks on new lines and on the | character.
So something like (?:([\r\n]+)|\|)

somesoni2
SplunkTrust
SplunkTrust

More specifically, this:

[YourSourceType]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\r\n|\|)
TIME_FORMAT=%d/%m/%Y-%H:%M:%S
TIME_PREFIX=tcp\s+
MAX_TIMESTAMP_LOOKAHEAD=19

beqanaveriani
New Member

somesoni2 Thanks a lot

0 Karma

FrankVl
Ultra Champion

Why do you want it as you show in your second screenshot?

Your first screenshot shows sensible event breaking to me. The event contains a multi valued sessions attribute, it doesn't make much sense to me to treat the contents of that field as separate events? But perhaps I'm missing the use case behind wanting to split it like you mention.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...