Splitting one event into multiple events

[Branden]

This should be a simple question. In fact, I've succeeded in doing this before, but I no longer have that app and I can't recall the solution.

I run a script that outputs something like the following:

Queue          Status
-----          ------
MTAB208A       READY
MTAB310C       READY
MTAB318A       READY
MTAB318B       READY

I want Splunk to alert me when the "READY" status changes to "DOWN" (or something other than "READY").

So I wrote a script that uses sed to remove the first two lines, so the output becomes:

MTAB208A       READY
MTAB310C       READY
MTAB318A       READY
MTAB318B       READY

I want Splunk to extract two fields: queue and status. This is easy enough except I want each of those queues to be its own event. Instead, I get one big event containing all four queues.

How do I get each of those queues to be its own event? I know there's an easy way to do this but I'm having a mind block here. (I suppose the other option is to do away with the sed trimming and use multikv, but I think that might over-complicate this.)

I tried using LINE_BREAKER in props.conf but that didn't do anything:

LINE_BREAKER = ^\w+\s+\w+

Update: Figured it out! I needed to use "MUST_BREAK_AFTER". Oh yeah, and bounce Splunk after updating props.conf.

Thanks!

[AmitKapila]

I tried it after changing /opt/splunkforwarder/etc/apps/Metro_TA_iibcorp/local/props.conf but it fails again to split the EventType.

[metro:iibcorpqmon]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

Is the props .conf in the correct place?

[aaraneta_splunk]

@AmitKapila - This question is quite old and it may not garner the type of attention and activity that you seek. I would suggest posting a new question. Thank you.

[ziegfried · Accepted solution]

You should split the events at index time by specifying something like this in your props.conf:

[your_sourcetype]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

[Branden]

Aaaah okay. I got it working with: MUST_BREAK_AFTER = ^\w+\s+\w+ Does that seem reasonable too? Thanks!