Splunk Search

How to configure Splunk to break events after an empty line or before certain strings?

dhavamanis
Builder

We have the logs like below pattern. We want to break the events after an empty newline or starting before ERROR: or starting before TypeError:

Can you please tell us how to adjust this props.conf entry, seems this is not breaking based on empty newline,

[nodejs_stdout]
BREAK_ONLY_BEFORE = (^\n)|(^\r)|(^\n\r)|(^\r\n)|(^ERROR:)|(^TypeError:)
category = Custom
pulldown_type = true
TRUNCATE = 0

#######################################

> hydra-demo@0.3.27 start /opt/nbcuni/apps/hydra-chiller/app
> better-npm-run start "/opt/nbcuni/apps/hydra-chiller/app/"

running better-npm-run in /opt/nbcuni/apps/hydabcra-chiller/app
Executing script: start

to be executed: hydra start /opt/nbcuni/apps/hydra-chiller/app/
to be executed: ASSETS_PATH="/opt/nbcuni/apps/hydra-chiller/app/static" SERVER="/opt/nbcuni/apps/hydra-chiller/app/src/server.js" CLIENT="/opt/nbcuni/apps/hydra-chiller/app/src/client.js" NODE_PATH="/opt/nbcuni/apps/hydra-chiller/app:/opt/nbcuni/apps/hydra-chiller/app/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules:$NODE_PATH" ROOT_DIR="/opt/nbcuni/apps/hydra-chiller/app" npm run start

> hydra-dev@0.2.2 start /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev
> NODE_ENV=production node ./server.start.js

==> ð  Open http://localhost:3000 in a browser to view the app.
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesContextWrapper.js:23:19)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:100:28
    at flush (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/_microtask.js:18:9)
    at nextTickCallbackWith0Args (node.js:420:9)
ERROR: getRequest failed
{ timestamp: '2016-07-19T16:12:00.844+0000',
  status: 404,
  code: '100',
  message: '/content/media-gallery/ with (id = slasher-episode-1-behind-scenes-0) was not found',
  path: '/chillertv/content/media-gallery/slasher-episode-1-behind-scenes-0' }
undefined
 r
rlleryIndexctCompositeComponent.js.js:146:11lleryIndexlleryIndex.jsnnot read property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:153:16ntComponent
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesCastIndex.js:22:25)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:285:24)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
 r
rnnoictCompositeComponent.js reaCastIndeCastIndeCastIndex.js:82:24.componentWillMount.js property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:210:12ntComponent
bject Object].ReactCompositeComponentMixin.


####################################
0 Karma
1 Solution

twinspop
Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

View solution in original post

twinspop
Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

sundareshr
Legend

Try this

[ nodejs_stdout ]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=([\n\r]|Type|ERROR)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...