Splunk Search

What is the configuration so that the following events show independently in the Splunk search?

cesarbmx
Engager


Could someone help me with the Splunk configuration so that the following events show independently in the Splunk search?

cesarbmx_0-1652281754910.png

 

 

[my_sourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = 
TIME_FORMAT = 

 

 

 

 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

On your indexer/heavy forwarder (whichever comes first)

[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\{\"Event)
MAX_TIMESTAMP_LOOKAHEAD = 33
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7Q%:z
TIME_PREFIX = Timestamp\"\:\"

View solution in original post

somesoni2
Revered Legend

Give this a try

On your indexer/heavy forwarder (whichever comes first)

[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\{\"Event)
MAX_TIMESTAMP_LOOKAHEAD = 33
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7Q%:z
TIME_PREFIX = Timestamp\"\:\"

richgalloway
SplunkTrust
SplunkTrust

That LINE_BREAKER setting should have worked.  See if this one works any better.

LINE_BREAKER = ()\{"Event

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...