I am doing a monitor file input of a nessas scan data files.
Splunk reads the files in as one event per line.
The report on each system scaned is between the following to tags in the data file
<ReportHost name="xxx.xxx.xxx.xxx">
</ReportHost>
there can be as many as 3 or 4 hundred lines between these tags
I have two questions
1) What is the best way to put the data into splunk so that all the "ReportHost" info is together for searching reporting on each system?
2) how do I get the multi event information already in the splunk index together into one event for each ReportHost so that I can use the existing data to develop reports?
You have to possibilities :
http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents
in props.conf of the indexer
[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>
(the < and > may be missing before.)
and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...
see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction
sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"
and tune using all the other options (maxspan, maxpause ...)
You have to possibilities :
http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents
in props.conf of the indexer
[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>
(the < and > may be missing before.)
and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...
see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction
sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"
and tune using all the other options (maxspan, maxpause ...)
Thats it thanks this works