×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
Megamuch
Engager
Member since: ‎04-18-2011
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎04-18-2011
Activity Feed
Topics I've Started
View All

Re: Help with props.conf, LINE_BREAKER

by in Getting Data In
‎05-04-2011 07:11 AM
‎05-04-2011 07:11 AM
I have tried the following settings without success: LINE_BREAKER = ~\\ LINE_BREAKER = ~\\^ LINE_BREAKER = ([~\\]+) LINE_BREAKER = (.*)[~\\](.*) LINE_BREAKER = .*~\\.* An example string would be: SMSEUCP_7110:STATUS:1049110|7116|7110|192.168.0.5 1180178|7112|7110|192.168.0.5 14156304|7111|7110|192.168.0.5 1180174|7117|7110|192.168.0.5 1180170|7119|7110|192.168.0.5 5767676|7113|7110|192.168.0.5 5308816|7114|7110|192.168.0.5 1573452|7115|7110|192.168.0.5 2426006|7118|7110|192.168.0.5 11141326|7110|7110|192.168.0.5~\SMSEMO_0000:S:(0000) Incoming : 3161234567 oh really? let do that then, ok?~\SMSEMO_0000:P:Posting : http://someurlwithparameters~\ The end result should be multiline events split by ~\ like so: Event 1: SMSEUCP_7110:STATUS:1049110|7116|7110|192.168.0.5 1180178|7112|7110|192.168.0.5 14156304|7111|7110|192.168.0.5 1180174|7117|7110|192.168.0.5 1180170|7119|7110|192.168.0.5 5767676|7113|7110|192.168.0.5 5308816|7114|7110|192.168.0.5 1573452|7115|7110|192.168.0.5 2426006|7118|7110|192.168.0.5 11141326|7110|7110|192.168.0.5 Event 2: SMSEMO_0000:S:(0000) Incoming : 3161234567 oh really? let do that then, ok? Event 3: SMSEMO_0000:P:Posting : http://someurlwithparameters I'm no regexp guru, but I thought this would be easier 😉 ... View more

Help with props.conf, LINE_BREAKER

by in Getting Data In
‎05-04-2011 02:49 AM
2 Karma
‎05-04-2011 02:49 AM
2 Karma
While testing out Splunk I wanted to see if I could easily create a custom input into splunk using ncat and the UDP splunk input. The input works, now I have to tell splunk how to split the input stream. The input is a multiline string which contains either XML or pipe (|) delimited data but is always terminated by ~\ So I created a new props.conf in %$SPLUNK_HOME%/etc/system/local/ and added the following: [source::c:\\splunkinput\\my.log] LINE_BREAKER = ^~\$ Unfortunately nothing happens and I have not yet figured out how to check what exactly is going when importing a new file into splunk. The end result should be for every sequence (with carriage returns etc) between ~\ should be considered a new event. Any tips? P.s. is there a way to activate the props.conf changes without restarting splunkd? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
View All