Splunk Search

How to create a regex or rex in a search to extract each line in a log event to separate events?

mani3033
New Member

Hi Splunk Gurus - I am new to splunk, need your help on the below.

Below is how the events are getting into splunk, every event have multiple lines. Need a REX or REGEX to split every line as individual events.

15:44:26,951  INFO ALPSessionListener:21 - Session destroyed
15:44:27,437  INFO HomeController:121 - mapping -----/home
15:44:27,451  INFO AccessCardUtility:98 - In query payment method {https://alp.doc.company.com/doc/ccpwebservice/ServiceWeb.svc}
15:44:27,586  INFO HomeController:497 - User roles ----[Supervisor]
15:44:27,617  INFO ALPFilter:49 - User name:{InitialLogin}, Session Id:{x71d4QsDMRp0tpUAYH-LnEn-KRPdDPmsbgQpBLi7}, Login Date Time:{2018-09-05T15:44:27.617}, Resource accessing:{http://alp.doc.company.com/doc/WEB-INF/layout/GenericLayout.jsp}, Time Taken:{181ms}
15:44:27,904  INFO ALPInterceptor:70 - User has access to the URL/alp/ReconcileCashDrawer:{true}
15:44:27,904  INFO ReconcileCashDrawerController:121 - mapping -----/ReconcileCashDrawer
15:44:27,932  INFO ALPFilter:49 - User name:{JP19630}, Session Id:{fVrI3lxJKtjsd-IsoEr7An-14xrq}, Login Date Time:{2018-09-05T15:44:27.932}, Resource accessing:{http://alp.doc.company.com/doc/WEB-INF/layout/GenericLayout.jsp}, Time Taken:{28ms}
15:44:28,152  INFO ALPSessionListener:15 - ALP session created
15:44:28,207  INFO HandleDlsPaymentController:634 - payment response is ---org.datacontract.schemas._2004._07.Common_Payment_Common.GetPaymentInfoResponse@468bfb00
15:44:28,214  INFO RecPaymentController:71 - XML recieved {
15:44:28,214  INFO XMLUtility:51 - IN XML UTILITY
15:44:28,234  INFO ALPFilter:49 - User name:{InitialLogin}, Session Id:{gg6KJGawjksfdklafklto9ju8aQTzvaP2PLRum}, Login Date Time:{2018-09-05T15:44:28.234}, Resource accessing:{http://alp.doc.company.com/doc/settleSuccessful}, Time Taken:{783ms}
15:44:28,266  INFO ALPProductLlpsDAO:130 - number of products passed are {2}
15:44:28,346  INFO ALPSessionListener:15 - ALP session created
0 Karma
1 Solution

493669
Super Champion

try this in props.conf

[sourcetype_name]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

View solution in original post

0 Karma

imthesplunker
Path Finder

Try in props.conf.

[sourcetype_name]
LINE_BREAKER =  ([\r\n]+)\d{1,2}\:\d{1,2}\:\d{1,2}
SHOULD_LINEMERGE = false
TIME_FORMAT = %H:%M:%S,%3N
TIME_PREFIX = ^
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi Mani.. this whole logs is a single event?!?!
by using regex, do you want to get single line as a separate "event"?!?!?

Need a REX or REGEX to split every line as individual events //
once indexed, we can not use rex/regex to split the events to individual events..

by rex/regex, we can "extract" the lines and then do some calculations/reportings, etc..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mani3033
New Member

Yes the app team writes the dump in to log file so many lines in one event, i used props.conf finally

0 Karma

493669
Super Champion

try this in props.conf

[sourcetype_name]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
0 Karma

mani3033
New Member

Thanks for all you responses, Finally i used the props.conf instead of trying to parse in the runtime search. It worked.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...