Splunk Search

How to configure Splunk to break events after an empty line or before certain strings?

dhavamanis
Builder

We have the logs like below pattern. We want to break the events after an empty newline or starting before ERROR: or starting before TypeError:

Can you please tell us how to adjust this props.conf entry, seems this is not breaking based on empty newline,

[nodejs_stdout]
BREAK_ONLY_BEFORE = (^\n)|(^\r)|(^\n\r)|(^\r\n)|(^ERROR:)|(^TypeError:)
category = Custom
pulldown_type = true
TRUNCATE = 0

#######################################

> hydra-demo@0.3.27 start /opt/nbcuni/apps/hydra-chiller/app
> better-npm-run start "/opt/nbcuni/apps/hydra-chiller/app/"

running better-npm-run in /opt/nbcuni/apps/hydabcra-chiller/app
Executing script: start

to be executed: hydra start /opt/nbcuni/apps/hydra-chiller/app/
to be executed: ASSETS_PATH="/opt/nbcuni/apps/hydra-chiller/app/static" SERVER="/opt/nbcuni/apps/hydra-chiller/app/src/server.js" CLIENT="/opt/nbcuni/apps/hydra-chiller/app/src/client.js" NODE_PATH="/opt/nbcuni/apps/hydra-chiller/app:/opt/nbcuni/apps/hydra-chiller/app/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra/node_modules:/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules:$NODE_PATH" ROOT_DIR="/opt/nbcuni/apps/hydra-chiller/app" npm run start

> hydra-dev@0.2.2 start /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev
> NODE_ENV=production node ./server.start.js

==> ð  Open http://localhost:3000 in a browser to view the app.
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesContextWrapper.js:23:19)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:100:28
    at flush (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/_microtask.js:18:9)
    at nextTickCallbackWith0Args (node.js:420:9)
ERROR: getRequest failed
{ timestamp: '2016-07-19T16:12:00.844+0000',
  status: 404,
  code: '100',
  message: '/content/media-gallery/ with (id = slasher-episode-1-behind-scenes-0) was not found',
  path: '/chillertv/content/media-gallery/slasher-episode-1-behind-scenes-0' }
undefined
 r
rlleryIndexctCompositeComponent.js.js:146:11lleryIndexlleryIndex.jsnnot read property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:153:16ntComponent
TypeError: Cannot read property 'seasons' of undefined
    at _callee$ (SeriesCastIndex.js:22:25)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:341:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at tryCatch (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:88:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:285:24)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/regenerator/runtime.js:121:21)
    at step (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:20
    at run (/opt/nbcuni/apps/hydra-chiller/app/node_modules/hydra-dev/node_modules/babel-runtime/node_modules/core-js/library/modules/es6.promise.js:87:22)
 r
rnnoictCompositeComponent.js reaCastIndeCastIndeCastIndex.js:82:24.componentWillMount.js property 'title' of undefined
bject Object].ReactCompositeComponentMixin.
uppctCompositeComponent.js]/[hydra]/[react]/lib/ReactReconciler.js:37:35ppctReconciler.js]/[hydra]/[react]/lib/ReactCompositeComponenReactReconciler.mountComponent.js:210:12ntComponent
bject Object].ReactCompositeComponentMixin.


####################################
0 Karma
1 Solution

twinspop
Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

View solution in original post

twinspop
Influencer

I prefer LINE_BREAKER to BREAK_ONLY_BEFORE. And I'd be careful with TRUNCATE = 0 as well. The following should break after a new line followed by another new line, "ERROR" or "TypeError".

[nodejs_stdout]
LINE_BREAKER = ([\r\n])[\r\n]|ERROR|TypeError
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRUNCATE = 100000

View solution in original post

sundareshr
Legend

Try this

[ nodejs_stdout ]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=([\n\r]|Type|ERROR)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!