Separating merged events

[rgcox1]

I'm trying to develop a regex to separate merged events from a log. Here's my stanza in props.conf:

[source=c:\temp\nagios*-perfdata]
SHOULD_LINEMERGE = true
LINE_BREAKER = ([\r\n]+)
BREAK_ONLY_BEFORE = ^DATATYPE::

I've tried various regex's for BREAK_ONLY_BEFORE, all of which work in my regex tester.
Don't think I really need LINE_BRAKER, but have tried with and without.
Any help would be appreciated.

[gkanapathy · Accepted solution]

• It's not [source=path], it should be [source::path].
• Furthermore, \ (backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
• And for Windows file paths, it's probably a good idea to make the source match case-insensitive, so: [source::(?i)c:\\temp\nagios*-perfdata]
• You can't add comments in Splunk config files with a # except at the beginning of a line, i.e., if the comment with # tried with and without... are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+), what you think is a comment is taken as part of the line breaker regex.
• Neither of these settings is necessary normally as it looks like you're trying to set them to the default values in Splunk anyway.

[rgcox1]

Thanks. That got it working on my test instance on Windows, so I moved it to the production Linux box and it's working great!