Splunk Search
Highlighted

Need to break the events before certain word.

Path Finder

I've log file something like below,

DA FILE: /archive/attr/ABC/XYZ/20170911/file.log-new*** Files traversed: 128 - and  file format matches ***
DA FILE: /archive/attr/ABC/XYZ/20170911/file.log-newCreating the follwing directory for today's date: /mktaccess/archive/attr/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/attr/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/hello-US/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/hello-US/abc/xyz/20170911

Log format is like a paragraph.. It's the stdout and stderr output of a script
I need to break the line after ******* and before Creating. I'm writing something like below
[test]
SHOULDLINEMERGE=false
NO
BINARYCHECK=true
BREAK
ONLYBEFORE=Creating
MUST
BREAKAFTER=^\d{8}
TIME
FORMAT=%Y%m%d
TIME_PREFIX=(OR\w*\/)+

0 Karma
Highlighted

Re: Need to break the events before certain word.

SplunkTrust
SplunkTrust

Your question appears to have had formatting changes that are making answering it difficult. Please highlight your example text and use the 101010 formatting option the help make the text come through properly.

0 Karma
Highlighted

Re: Need to break the events before certain word.

Path Finder

@cpetterborg I've made necessary changes, please take a look

0 Karma
Highlighted

Re: Need to break the events before certain word.

SplunkTrust
SplunkTrust

With the data you have, you can't break up the line into different events without loosing some data, and even that has some issues.

If you don't mind doing it at search time, instead of at index time, it can be done pretty easily. You can do something like this:

... | rex mode=sed "s/(\*\*|Creating)/|\\1/g"
| rex max_match=0 "\|(?P<part>[^\|]+)"
| mvexpand part
| table _time, part

You may add any additional fields to the table, but it worked on the example data that you provided to break the event up into multiple events for further processing.

Splunk doesn't like to split up lines like that. If the data coming in had a character (like I used the |), then you could break it up at index time, and only loose the |.

Highlighted

Re: Need to break the events before certain word.

SplunkTrust
SplunkTrust

If this works for you, I can change this comment to an answer and then you can accept it so that it can be marked as solved. Thanks!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.