thanks @livehybrid - the documentation was just what we needed, we've got the multilines working perfectly now. for anyone else this is what we added (the multilineConfigs) for log4j that started lines with YYYY-MM-DD spec:
values:
logCollection:
containers:
multilineConfigs:
- namespaceName:
value: <NS>
podName:
value: <podName>-*
useRegexp: true
firstEntryRegex: ^\d{4}\-\d{2}\-\d{2}\s
... View more
Hi - we have been sending data from our K8s cluster to splunk hwf which then forwards to the indexer. It works great except for multiline events - particularly stack traces. I have setup the sourcetype and validated it line breaks correctly with the data inputs file input gui. I've got the sourcetype defined in a props on the hwf and can choose it from the drop down in the gui and it does the line breaks. I also have a transform that adds a new field so I know its hitting the props. However i'm still only getting one line per event. I'm wondering if there's something that needs to be set in opentelemetry to configure the line breaking before it goes to the hwf. if it helps this is the sourcetype [kube:container:test-app] LINE_BREAKER = ([\r\n]+)\w{3} \d{4} NO_BINARY_CHECK = true category = Custom pulldown_type = true BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = MAX_TIMESTAMP_LOOKAHEAD = 25 SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%d %H:%M:%S TRUNCATE = 0 Thank you for any help
... View more
I've been running into errors where larger searches are getting cancelled. I read this could be due to running out of memory. I looked at my search head which is running on a server with 32 gb but only using 8gb (numbers from monitoring console) I'm assuming there's some setting to increase how much memory is allocated to splunk but i haven't found it. I've seen settings for memory per search - is the overall memory calculated from allowed number of searches and memory per search? thanks
... View more