Why are logs coming up with hyphens/dashes?

[jackin]

Can anyone suggest why the logs are coming up like this? I added the monitoring stanza.

Could anyone suggest some troubleshooting steps/solution?

inputs.conf stanza

[monitor:///opt/netmonitor/LOG/*]
index = osnix
sourcetype = ping_status_log_new
crcSalt = <SOURCE> 

[gcusello]

Hi @jackin,

The logs you're indexing contain a line separation.

You couls filter it following the instructions at https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data...

in few words:

in props.conf

[ping_status_log_new]
TRANSFORMS-null= setnull

in transform.conf

[setnull]
REGEX = \-{10}
DEST_KEY = queue
FORMAT = nullQueue

Ciao.

Giuseppe

[PickleRick]

That can also be a separator between events and the events themselves can be multilined.

In such case you'd do something like

LINE_BREAKER = (-{20,}[\r\n])
SHOULD_LINEMERGE = false