Splunk Search

LINE BREAKER REGEX

patriziadepaola
Explorer

Hello, i need to identify i new line in my log file when line starts with MSG or ERR in order to get the message of error in a single line.

Sample log file data:

MSG;1193342275;1784053093;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,286; - START
MSG;1193342275;1889771202;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,305; - START
ERR;1193342275;573025154;gestoreprocessi;Log.fatal;29/06/2017 05:36:14,312;org.springframework.dao.DataAccessResourceFailureException: SqlMapClient operation; SQL [];

--- The error occurred in com/cervedgroup/cicloattivo/gestoreprocessi/db/dao/ibatis/maps/ReportWorkflowProcessi.xml.

--- The error occurred while applying a result map.

--- Check the GetIdWorkflowFromIdReport-AutoResultMap.

--- Check the result mapping for the 'ID_WORKFLOW' property.

--- Cause: java.sql.SQLRecoverableException: Closed Resultset: next; nested exception is com.ibatis.common.jdbc.exception.NestedSQLException:

--- The error occurred in com/cervedgroup/cicloattivo/gestoreprocessi/db/dao/ibatis/maps/ReportWorkflowProcessi.xml.

--- The error occurred while applying a result map.

--- Check the GetIdWorkflowFromIdReport-AutoResultMap.

--- Check the result mapping for the 'ID_WORKFLOW' property.

--- Cause: java.sql.SQLRecoverableException: Closed Resultset: next
MSG;1193342275;1889771202;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,315; - elabToElab:com.cervedgroup.cicloattivo.gestoreprocessi.db.ReportElab@6da21389
MSG;1193342275;1889771202;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,315; - elabToElab stato:SND

Any suggestions?

Tags (1)
0 Karma
1 Solution

patriziadepaola
Explorer

I have found the solution:

BREAK_ONLY_BEFORE = MSG | ERR

it works !

View solution in original post

patriziadepaola
Explorer

I have found the solution:

BREAK_ONLY_BEFORE = MSG | ERR

it works !

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...