Getting Data In

props/transforms.conf

dbcase
Motivator

Hi,

I have the below data and I know that props and/or transforms.conf need to be modified to have the below report as 1 event. I'm not that familiar with how props/transforms.conf work since we have Splunk Cloud and have never modified them.

Premise= 135019
Name= Front Door
    IP= 172.16.12.103
    ID= 1
    Mac= E8:F2:E2:2D:CB:73
    FW Ver= 0.9.2.1708101
    Manufacturer= LGInnotek
    Model= Titan
    Video Size= LARGE
    Verified= true
    RSSI= -79 dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= https://172.16.12.103:80/openhome/streaming/channels/0/flv
    MJPEG URL= https://172.16.12.103:80/openhome/streaming/channels/2/mjpeg
    API Version= 3.3.7
    MotionTurnedOn= true
    MotionSensitivy= 1 (LOW)
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your logs always starts with Permise=.., try this

props.conf on Indexer/HF

[yourSourcetype]
LINE_BREAKER = ([\r\n]+)(?=Premise\=\s\S+)
SHOULD_LINEMERGE = false
#Don't see any timestamp on the data so using current time
DATETIME_CONFIG=CURRENT

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming your logs always starts with Permise=.., try this

props.conf on Indexer/HF

[yourSourcetype]
LINE_BREAKER = ([\r\n]+)(?=Premise\=\s\S+)
SHOULD_LINEMERGE = false
#Don't see any timestamp on the data so using current time
DATETIME_CONFIG=CURRENT
0 Karma

solarboyz1
Builder

In your props.conf for this sourcetype, you could try using a line_breaker to split, assuming all events start with "Premise="

[sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)Premise=
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...