This one is a bit tricky I think. Breaking the events up based on the INIT line should be easy enough. Tying those back to the description is tougher. In Splunk, we have to create an event first from the data streaming in. It's not like we're parsing a file in whole, we're processing it as it streams by. And so we can't grab the header, store it and then tag that data to other events....at least no way that i know how.
BUT, we can do some things. For example, we can set the entire header aside as its own event and give it a different sourcetype. And then create events for the job actions. Later on when we search the data, we should be able to tie together those two events based on the host and source - since they will match. So at that point, we can sort of glue the description back in.
Not sure if it's the best method to do this, but maybe it's one. This quick example assumes the sourcetype set when you ingest the logs is app:job:log and creates one called app:job:header....both of which are easily changeable of course.
Indexer/Parse Config (On your indexers)
props.conf
[app:job:log]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\[[^\]]+\]\s*'INIT')
TIME_PREFIX = ^\[
MAX_TIMESTAMP_LOOKUPAHEAD = 20
TRANSFORMS-header_sourcetype = set_app_job_header_sourcetype
transforms.conf
[set_app_job_header_sourcetype]
REGEX = ^\[[^\]]+\]\s*#{5}
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::app:job:header
Search Config (on your search heads)
props.conf
[app:job:header]
REPORT-header_fields = app_job_header_fields
transforms.conf
[app_job_header_fields]
REGEX = \]\s+#\s+([^:]+):\s*([^\r\n]+)
FORMAT = $1::$2
And then assuming all that works, a simple sample search might be like
index=app sourcetype=app:job:*
| eventstats values(Description) as Description by host source
| where sourcetype="app:job:log"
... View more
