Getting Data In

Line Breaking event into multiple events -

splunker12er
Motivator

Sample log:

Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: PCI bridge to [bus 11-11]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [io  0xf000-0x0000] (disabled)
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [mem 0xd3d00000-0xd3dfffff]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [mem 0xd5300000-0xd53fffff 64bit pref]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.7: PCI bridge to [bus 12-12]

props.conf:

[my_custom]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true

I set the above property to break that single event , but it seems it doesnt work, since the Timestamp is same in all the events does it always consider this as a single event ?

or any other settings to include in my props ? Please help

Source : http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Indexmulti-lineevents

0 Karma

lguinn2
Legend

If all events are a single line, it would be significantly more efficient to do this:

 [my_custom]
 SHOULD_LINEMERGE = false

Also, your settings are the default, so you shouldn't need them anyway. Is it possible that Splunk is not interpreting the timestamp correctly? If Splunk doesn't recognize the timestamp, then your BREAK_ONLY_BEFORE_DATE = true setting will not work.

my_custom should be the name of the sourcetype of the data - it must match exactly, including case.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...