Getting Data In

How to configure line breaker?

sgarcia
Explorer

Hola comunidad 

I'm trying to configure the props file so that the following event starts from the third line:

sgarcia_0-1676491362546.png

Currently, I am testing as follows:

sgarcia_1-1676491426647.png

 

If I leave this setting, the timestamp of the first few lines will be taken from splunk, but it should take the timestamp of the lines with date.

Regards

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sgarcia,

you have to filter the first three rows using something l.ike this:

in props.conf:

[yoursourceytpe]
SHOULD_LINEMERGE = false
TRANSFORMS-removeheaderevent = setnull

in transforms.conf:

[setnull]
REGEX = ^(REPORTESDEBIT|TotalMovimientos|Id;Usuario)
DEST_KEY = queue
FORMAT = nullQueue

Please, next time, put the log samples in the Code/Sample box instead using a printscreen so we can use it to answer.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sgarcia,

you have to filter the first three rows using something l.ike this:

in props.conf:

[yoursourceytpe]
SHOULD_LINEMERGE = false
TRANSFORMS-removeheaderevent = setnull

in transforms.conf:

[setnull]
REGEX = ^(REPORTESDEBIT|TotalMovimientos|Id;Usuario)
DEST_KEY = queue
FORMAT = nullQueue

Please, next time, put the log samples in the Code/Sample box instead using a printscreen so we can use it to answer.

Ciao.

Giuseppe

sgarcia
Explorer

REPORTESDEBITACORAGRAL;;;;;;;;;;
TotalMovimientos:;;;;;;;;;;
ID;Usuario;Fecha/Horadecaptura;Tipodeoperacion;Clave;Emisor;Receptor;MediodeEntrega;Importe;Estado;TipodeError
1675816017182;DKXMMHA;07/Feb/202318:26hrs.;Logout;FinSesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675815710949;DKXMMHA;07/Feb/202318:21hrs.;Login;Ini.SesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814586855;SPEI;07/Feb/202318:03hrs.;AvisoTraspasoOK;2035;Sindefinicion;Sindefinicion;Sindefinicion;30,430,522.05;OK;
1675814481168;SPEI;07/Feb/202318:01hrs.;Act.delCat.Ins.;EnsesionInstituciones.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814481200;SPEI;07/Feb/202318:01hrs.;Act.delCat.Cert.;EnsesionCertificados.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;
1675814481231;SPEI;07/Feb/202318:01hrs.;Act.delCat.Nvls.;EnsesionNiveles.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sgarcia,

please try this regex:

^(REPORTESDEBITACORAGRAL|TotalMovimientos|ID;Usuario)

that you can test at https://regex101.com/r/0m8hng/1

Ciao.

Giuseppe

sgarcia
Explorer

Thank you, i try the configuration, and comeback as soon .

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...