Splunk Search

Concatenation of records between two keywords ?

pck_npluyaud
Explorer

Hello.

It is not a question, it is a use case that I don't arrive to resolve.

The situation :

  • a log file on remote server, with a Splunk Universal Forwarder and only an inputs.conf (not other conf)
  • a props.conf on Heavy Forwarder with
    • LINE_BREAKER = \d{1,4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}(,|.)\d{1,3}\s\[

The default format : 2020-12-07 08:02:24.350 [<thread>] <type> <bla bla bla ...>

When the record is a Java Exception logging, there is no problem. The record is complete and contain all the stacktrace (SHOULD_LINEMERGE = TRUE)

But I have other cases which group together a whole set of lines. And each time, the first line contains the word "started", and the last the word "ended". For example, this is for Splunk only one log. But I would like 4 !

 

 

 

2020-12-07 08:02:30,567 [http-nio-10.108.181.36-30000-exec-6] INFO  p.a.f.s.w.FrontalAuthentRestController 869 -  - b- health-check started.  (FrontalAuthentRestController.java:37) 
2020-12-07 08:02:30,583 [http-nio-10.108.181.36-30000-exec-6] INFO  p.a.f.s.w.FrontalAuthentRestController 869 -  - b- health-check ended.  (FrontalAuthentRestController.java:44) 
2020-12-07 08:02:34,670 [http-nio-10.108.181.36-30000-exec-9] INFO  p.a.f.s.w.FrontalAuthentRestController 845 -  - b- health-check started.  (FrontalAuthentRestController.java:37) 
2020-12-07 08:02:34,684 [http-nio-10.108.181.36-30000-exec-9] INFO  p.a.f.s.w.FrontalAuthentRestController 845 -  - b- health-check ended.  (FrontalAuthentRestController.java:44) 

 

 

 

I find the same problem with "proxy started" / "proxy ended", or "doFilter started" / "doFilter ended"...

Each time, Splunk gathers the recordings into one

 

 

 

2020-12-07 08:01:43,430 [http-nio-10.108.181.35-30000-exec-3] INFO  p.a.f - proxy started.  (Proxy.java:106) 
2020-12-07 08:01:43,433 [http-nio-10.108.181.35-30000-exec-3] INFO  p.a.f. - IDPART = // NUINPE = (Proxy.java:108) 
2020-12-07 08:01:43,443 [http-nio-10.108.181.35-30000-exec-3] INFO  p.a.f - /3  (ProxyHelper.java:49) 
2020-12-07 08:01:43,444 [http-nio-10.108.181.35-30000-exec-3] INFO  p.a.f. - /3  (Proxy.java:114) 
2020-12-07 08:01:43,907 [http-nio-10.108.181.35-30000-exec-3] INFO  p.a.f - proxy ended.  (Proxy.java:124) 

 

 

 

Do you have an idea ?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...