Splunk Search

How to regex events with "==========================" as event breaker?

kiran331
Builder

How to break the events with using regex with "==========================" as event breaker?

event:

PS C:\tetst\tethttb>
"ERROR: Parameter ""-ComputerName"" requires an argument."

Copyright (C) 2013 Microsoft Corporation. All rights reserved.

"ERROR: fd""-fgrgf"" requires an vcv."
Copyright (C) 2013 Microsoft gfg. All rights reserved.

BitLocker Drive Encryption: rTool version 10.0.rtret

"If the ""-cn"" parameter was specified, check that the computer name is correct."
interface.
ERROR: An error occurred while connecting to the BitLocker management
Computer Name: rtffggh
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

BitLocker Drive Encryption: Configuration Tool version 10.0.15063

Tags (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (^=+$)
DATETIME_CONFIG = none

This is the more efficient approach because it doesnt require the line merging processor and also instructs splunk to not try to parse a timestamp (which there are none in your sample data). Please note the = signs will be removed from the data too, effectively reducing license spend.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (^=+$)
DATETIME_CONFIG = none

This is the more efficient approach because it doesnt require the line merging processor and also instructs splunk to not try to parse a timestamp (which there are none in your sample data). Please note the = signs will be removed from the data too, effectively reducing license spend.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kiran331,
in props.conf put

[your_sourcetype]
BREAK_ONLY_BEFORE = \={5,100}

Bye.
Giuseppe

landen99
Motivator

And: SHOULD_LINEMERGE = true. And unless more than 100 "=" is a deal breaker, you might as well just let it stop at 5:

[your_sourcetype]
BREAK_ONLY_BEFORE = \={5}
SHOULD_LINEMERGE = true
0 Karma

DalJeanis
Legend

@cusello, @landen99 - how does that map in the case that there might be some comment somewhere that happened to have ===== in the middle of a line?

Would you use ^={5,}, or is ^ not meaningful as start of line in BREAK_ONLY_BEFORE?

0 Karma

landen99
Motivator

jcat54's answer is much better. I learned something big from that answer; wish I had understood that a while ago. Also, you are correct that any comment with an equals sign in it 5 times would initiate an event break right before that line. I neglected the "^" because I suspected that some events might have space characters before the "=". I neglected matching more than 5 because once a match of 5 was complete, the rest didn't matter.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...