About toph3r

toph3r · ‎04-17-2019

You may want to doublecheck your line breaking. in the props.conf Docs page it says " * When using LINE_BREAKER to delimit events, SHOULD_LINEMERGE should be set to false, to ensure no further combination of delimited events occurs." SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) SHOULD_LINEMERGE says to try and merge lines together, but LINE_BREAKER=([\r\n]+) says to event break on every line. The test is going to be to check out the SQL message (Lines 7-11 in your original post). These should be interpreted as one event: 04/10/19 11:52:45 (275) Worker-Standard:JDBCProbe-69923714db3cf300e6067742399619af SELECT DISTINCT pco.PCO_Ref, pco.Act_Plan, pco.Description, pco.Impact, pco.Prioritet, pco.risk, pco.Txt_type, convert(varchar(MAX), pco.Txt) as Txt, pco.Urgency, status.CloseType, status.PCOClose, status.PCOPlan2, status.PCOrelease3, act.SenesteStart, act.SenesteEnd FROM "PobPco"."dbo"."PCO" pco join "PobPco"."dbo"."PCO_status" status on pco.PCO_Ref = status.PCO_Ref FULL outer join "PobPco"."dbo"."Act" act on pco.PCO_Ref = act.PCO_Ref and (act.Sequence='430' OR act.Sequence='491') Here is what I see as correct line breaking with the original config I posted. Where there something that was not working? It appears to work in the GDE app, I can't figure out how to get a decent sized pic, but checkout https://i.imgur.com/bCk91rM.png

toph3r · ‎04-11-2019

I am about to onboard SNow Mid logs in my env, so I will try to remember to update after I complete that. But based on your logs it looks like Splunk is trying to auto-break on a second date that is recognizes. Notice the difference between the event start datestamp and the datestamp on your line 18: 04/10/19 vs 10/04/2019 . Note the 2 digit vs 4 digit year, probably means that something else is generating that datestamp, possibly in the middle of an event. Though it is difficult to tell exactly what your second text box is the output from. I would define my LINE_BREAKER based on the datestamp that leads your event. I may end up changing it, but based on your first log block I would start with: [snow:mid] NO_BINARY_CHECK = true CHARSET = AUTO TIME_FORMAT = %m/%d/%y %H:%M:%S SHOULD_LINEMERGE = FALSE LINE_BREAKER=([\r\n]+)\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2} TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD=30

toph3r · ‎12-20-2018

I ended up implementing a terrible workaround. I am still open to better solutions... Example using the lookup table in the original post, I preceeded the first line (the one giving me issues) with single quote. value,comment '"foo" bar bat, double quotes around first word (with preceeding single quote) foo "bar" bat, double quotes around second word foo bar "bat", double quotes around third word """foo""" bar bat, triple-double quotes around first word \"foo\" bar bat, backslash escaped double quotes around first word '"foo" bar bat', single quotes around the whole field I was then able to use rex/sed to remove the single quote within my inputlookup |inputlookup test_lookup.csv| fields value, comment |rex field=value mode=sed "s/^\'\"/\"/" Resulting in the ultimate query of index=test source= foobarbat.txt NOT [ |inputlookup test_lookup.csv| fields value, comment |rex field=value mode=sed "s/^\'\"/\"/" ]

toph3r · ‎07-10-2018

I am trying to use the lookup to exclude "foo" bar bat from my results (e.g. index=test NOT [| inputlookup test_lookup.csv | fields value| format] ). So I guess I am looking for it to return \"foo\" bar bat However, it does appear to do some escaping of characters on its own, so I don't really know what I want it to "look" like, I just know what I want the end result to be, not to show the second line in the results of: source="foobarbat.txt" index="test" _time value 2018-07-01 11:30:00 something different 2018-07-01 11:00:00 "foo" bar bat edit: formatting

toph3r · ‎07-02-2018

Here's the output: ( ( comment="double quotes around first word" AND value="foo" ) OR ( comment="double quotes around second word" AND value="foo \"bar\" bat" ) OR ( comment="double quotes around third word" AND value="foo bar \"bat\"" ) OR ( comment="triple-double quotes around first word" AND value="\"foo\"" ) OR ( comment="backslash escaped double quotes around first word" AND value="\\\"foo\\\" bar bat" ) OR ( comment="single quotes around the whole field" AND value="'\"foo\" bar bat'" ) )

toph3r · ‎06-29-2018

I am using an input lookup to exclude results from a search (e.g. index=main NOT [| inputlookup test_lookup.csv | fields value]. The searches I am trying to exclude contain values with quotes, such as "foo" bar bat. It seems that if the first word in a lookup table value is surrounded in quotes, it will take the word surrounded in quotes as the value for that field and ignore the rest. A lookup of the example above returns only foo. Quotes appear to work find around words, so long as they are not the first word in the value. I've cruised around looking for the answer, and came across a number of posts suggesting triple quoting, using hex char value for quotes, etc and I've also tried a number of things on my own without any success. Thus I have come here. The lookup result I am trying to get is: "foo" bar bat Here is the contents of my lookup file: value,comment "foo" bar bat, double quotes around first word foo "bar" bat, double quotes around second word foo bar "bat", double quotes around third word """foo""" bar bat, triple-double quotes around first word \"foo\" bar bat, backslash escaped double quotes around first word '"foo" bar bat', single quotes around the whole field and here are the results of the lookup table: Thanks in advance for any assistance.

Posts	6
Solutions	2
Karma Given	0
Karma Received	1
Member Since	‎11-30-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Quotes around first word in inputlookup value

Re: Index Service-Now MID server logs

Re: Index Service-Now MID server logs

Re: Quotes around first word in inputlookup value

Re: Quotes around first word in inputlookup value

Re: Quotes around first word in inputlookup value

Quotes around first word in inputlookup value