Splunk Search

Separating merged events

rgcox1
Communicator

I'm trying to develop a regex to separate merged events from a log. Here's my stanza in props.conf:

[source=c:\temp\nagios*-perfdata]
SHOULD_LINEMERGE = true
LINE_BREAKER = ([\r\n]+)
BREAK_ONLY_BEFORE = ^DATATYPE::

I've tried various regex's for BREAK_ONLY_BEFORE, all of which work in my regex tester.
Don't think I really need LINE_BRAKER, but have tried with and without.
Any help would be appreciated.

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
  • It's not [source=path], it should be [source::path].
  • Furthermore, \ (backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
  • And for Windows file paths, it's probably a good idea to make the source match case-insensitive, so: [source::(?i)c:\\temp\nagios*-perfdata]
  • You can't add comments in Splunk config files with a # except at the beginning of a line, i.e., if the comment with # tried with and without... are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+), what you think is a comment is taken as part of the line breaker regex.
  • Neither of these settings is necessary normally as it looks like you're trying to set them to the default values in Splunk anyway.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
  • It's not [source=path], it should be [source::path].
  • Furthermore, \ (backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
  • And for Windows file paths, it's probably a good idea to make the source match case-insensitive, so: [source::(?i)c:\\temp\nagios*-perfdata]
  • You can't add comments in Splunk config files with a # except at the beginning of a line, i.e., if the comment with # tried with and without... are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+), what you think is a comment is taken as part of the line breaker regex.
  • Neither of these settings is necessary normally as it looks like you're trying to set them to the default values in Splunk anyway.

rgcox1
Communicator

Thanks. That got it working on my test instance on Windows, so I moved it to the production Linux box and it's working great!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...