Splunk Search

Separating merged events

Communicator

I'm trying to develop a regex to separate merged events from a log. Here's my stanza in props.conf:

[source=c:\temp\nagios*-perfdata]
SHOULD_LINEMERGE = true
LINE_BREAKER = ([\r\n]+)
BREAK_ONLY_BEFORE = ^DATATYPE::

I've tried various regex's for BREAK_ONLY_BEFORE, all of which work in my regex tester.
Don't think I really need LINE_BRAKER, but have tried with and without.
Any help would be appreciated.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
  • It's not [source=path], it should be [source::path].
  • Furthermore, \ (backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
  • And for Windows file paths, it's probably a good idea to make the source match case-insensitive, so: [source::(?i)c:\\temp\nagios*-perfdata]
  • You can't add comments in Splunk config files with a # except at the beginning of a line, i.e., if the comment with # tried with and without... are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+), what you think is a comment is taken as part of the line breaker regex.
  • Neither of these settings is necessary normally as it looks like you're trying to set them to the default values in Splunk anyway.

View solution in original post

Splunk Employee
Splunk Employee
  • It's not [source=path], it should be [source::path].
  • Furthermore, \ (backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
  • And for Windows file paths, it's probably a good idea to make the source match case-insensitive, so: [source::(?i)c:\\temp\nagios*-perfdata]
  • You can't add comments in Splunk config files with a # except at the beginning of a line, i.e., if the comment with # tried with and without... are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+), what you think is a comment is taken as part of the line breaker regex.
  • Neither of these settings is necessary normally as it looks like you're trying to set them to the default values in Splunk anyway.

View solution in original post

Communicator

Thanks. That got it working on my test instance on Windows, so I moved it to the production Linux box and it's working great!

0 Karma