About lcasey001

lcasey001 · ‎10-04-2016

We have this same issue running latest 4.1.0 version. It seems to try to run describe_log_stream against all log_groups at the same time which is probably causing the throttling. This is especially an issue when you have a large set of log_groups.

lcasey001 · ‎10-04-2016

I don't think you can. I tried almost every combination as well and wasn't able to do it myself. I ended resorting to this aws logs describe-log-groups --output text --query 'logGroups[*].[logGroupName]' |tr '\n' ',' . This however leads to other issues where a large amount of log_groups can cause ThrottlingExceptions

lcasey001 · ‎05-31-2011

Where can one obtain that list for future reference? I did not see anything in the props.conf.spec file.

lcasey001 · ‎05-31-2011

Thanks !!! That was it. It needed to be done on the indexer and not forwarder. So is there a list of things that needs to be done on the indexer vs forwarder regarding props.conf ?

lcasey001 · ‎05-31-2011

These changes have been on the Universal Forwarder where the log file is hosted. I have other settings on the forwarder for other log files, mostly setting sourcetypes in the props.conf file. Should this all be done on the indexer?

lcasey001 · ‎05-31-2011

Made your recommended change, restarted the forwarder, and got the same result. 5/31/11 3:31:17.000 PM modifiedOn: 2011-05-31 15:31:17 postalCode: 11111 promoCode: '' requestDetail: |- <request> <email>[email protected]</email> <userName>username</userName> <firstName>firstname</firstName> <lastName>lastname</lastName> <language>en</language> Show all 18 lines

lcasey001 · ‎05-31-2011

I have a file that has multiple multi line events. Each event is broken up into "INFO: ---" or "ERROR: ---" ERROR: --- blahNewsLetter: N birthdate: 1947-10-25 countryId: 1 createdOn: 2011-05-31 13:40:46 ... INFO: --- blahNewsLetter: ~ birthdate: 0000-00-00 countryId: ~ createdOn: 2011-05-31 13:40:48 ... My props.conf [dblog] SHOULD_LINEMERGE = true # force splunk to detec multiline events BREAK_ONLY_BEFORE = (.*)(INFO|ERROR): My inputs.conf [monitor:///var/log/dblog.log] disabled = false index = blah sourcetype = dblog blacklist = (\.(gz|bz2|z|zip)$) followTail = 1 This does not work. It is splitting the file up into events that have lines similar to the "createdOn: 2011-05-31 13:40:48" lines. modifiedOn: 2011-05-31 13:40:48 postalCode: 1111 promoCode: ~ requestDetail: |- <request> <billToEmail>null</billToEmail> <billToFirstName>Name</billToFirstName> <billToLastName>Name</billToLastName> <billToStreet1>null</billToStreet1> <billToStreet2>null</billToStreet2> ... and createdOn: 2011-05-31 13:40:48 email: [email protected] Any help would be appreciated. And I have also tried using BREAK_ONLY_BEFORE_DATE = false with same result. This is currently on the forwarder.

Posts	7
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎05-19-2011

Online Status	Offline
Date Last Visited	‎10-06-2022 05:25 PM

Split multi-line events

Re: Splunk Add-on for Amazon Web Services: Why do ...

Re: Splunk Add-on for Amazon Web Services: How can...

Re: Split multi-line events

Re: Split multi-line events

Re: Split multi-line events

Re: Split multi-line events

Split multi-line events

Join the Conversation