Event breaking not working properly with the below regex... props.conf LINE_BREAKER=([\r\n]+) My Log data : ('Hi-Spec JDA','Stuck Pick Work', 'No Pick Work - R/C','0','Stuck Pick Work','2019-07-17 09:10:01'); ('Hi-Spec JDA','Locking Sessions', 'None','0','Locking Sessions','2019-07-17 09:10:01'); ('Hi-Spec JDA','Database Locks', 'None','0','Database Locks','2019-07-17 09:10:01'); ('Hi-Spec JDA','Long Running Waves', 'None','0','Long Running Waves','2019-07-17 09:10:01'); ('Hi-Spec JDA','Broken Pipe Error', 'No Errors','0','Broken Pipe Error','2019-07-17 09:10:01'); ('Hi-Spec JDA','Invmov with Inspect Inventory', 'Attention: Movement with Inspect Inventory Found','1','Invmov with Inspect Inventory','2019-07-17 09:10:01'); ('Hi-Spec JDA','Movement Pick to VLM', 'No Movement going to VLM from Pick','0','Movement Pick to VLM','2019-07-17 09:10:01'); Issue here is, couple of lines are coming under the same event. From the above example... there are 7 new lines of logs and it should break into 7 events... But it breaks into 6 events as shown below.. EVENT 1 : ('Hi-Spec JDA','Stuck Pick Work', 'No Pick Work - R/C','0','Stuck Pick Work','2019-07-17 09:10:01'); EVENT 2 : ('Hi-Spec JDA','Locking Sessions', 'None','0','Locking Sessions','2019-07-17 09:10:01'); EVENT 3 : ('Hi-Spec JDA','Database Locks', 'None','0','Database Locks','2019-07-17 09:10:01'); EVENT 4 : ('Hi-Spec JDA','Long Running Waves', 'None','0','Long Running Waves','2019-07-17 09:10:01'); EVENT 5 (The one having issue) : ('Hi-Spec JDA','Broken Pipe Error', 'No Errors','0','Broken Pipe Error','2019-07-17 09:10:01'); ('Hi-Spec JDA','Invmov with Inspect Inventory', 'Attention: Movement with Inspect Inventory Found','1','Invmov with Inspect Inventory','2019-07-17 09:10:01'); EVENT 6 : ('Hi-Spec JDA','Movement Pick to VLM', 'No Movement going to VLM from Pick','0','Movement Pick to VLM','2019-07-17 09:10:01'); What I believe the issue in EVENT 6 has something to do with the length of the second line in EVENT 6 which is the longest. Can somebody please help me out here on how to rectify the issue.....???? ... View more

I have situation in hand here... I have a abc.txt file in server1 which I am monitoring using a forwarder. The abc.txt file updates every 1 hour in such a way that, the content of the whole file is cleared and the same content is written back to the abc.txt file. The issue in hand is, splunk is indexing the data from abc.txt everytime the content is removed and written back to the abc.txt file, which is resulting in duplication of the data multiple times. can somebody please help me in rectifying the issue..?? do i need to change the crcinitlength value..?? ... View more

Is it possible to integrate service now and splunk in such a way that whenever an incident comes in on service now, based on priority or short description or description, the particular incident is assigned to a particular queue or to a particular person. I hope I made myself clear...!! Example : An incident comes in Depending on the description a person from service desk manualy assigns the incident to a particular queue and to a particular person. My idea here is that splunk should parse through the description of the incident and it should decide which queue or resource the incident should be assigned to. Is it in any way possible? ... View more