Splunk Search

Splunk data doesn't split correctly

zhoayang
Engager

Hi Splunk team, 

When I used Splunk to search the log data and found it didn't split correctly, It displayed as below:

zhoayang_0-1643354979552.png

The two data have been combined together, Can anyone has some suggestions do this situation? appreciate it.

Labels (1)
0 Karma

gcusello
Legend

Hi @zhoayang,

could you share some sample of your original logs (not the oned displayed in Splunk search)?

please one of the event correctly parsed and one of the event not correctly parsed.

Anyway, in Community you can find many examples of JSON parsing e.g. https://community.splunk.com/t5/Getting-Data-In/How-to-parse-JSON-log-data/m-p/121521.

Ciao.

Giuseppe

yuanliu
SplunkTrust
SplunkTrust

It looks like a problem with LINE_BREAKER in props.conf. (See Configure event line breaking.)  By default Splunk indexer assumes "([\r\n]+)", i.e., a new line, to be the separator of events.  But some logs seem to have jammed into a single line.  There is no universal regex to break non-hierarchical structures like JSON.  So, it is best to ask developers to break events neatly.  If developers can guarantee that the first field is always "namespace" as in illustrated examples, you can try ([\r\n]+|}{"namespace":).

There is a dedicated forum Getting Data In in which this type of issues are discussed.

Tags (2)
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...