Getting Data In

After upgrade to 4.2 the Events from Windows Eventslogs are partially not working, lines broken at random positions

zliu
Splunk Employee
Splunk Employee
1 Solution

zliu
Splunk Employee
Splunk Employee

In Splunk 4.1.x the LINE_BREAKER setting for the stanza [source::WinEventLog...] in the config $SPLUNK_HOME/etc/system/default/props.conf has been set to:

LINE_BREAKER =([\r\n](?=\d\d/\d\d/\d\d \d\d:\d\d:\d\d [aApPmM]{2}))

this changed to the following in 4.2:

LINE_BREAKER =([\r\n](?=\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [aApPmM]{2}))

Workaround:

LINE_BREAKER =([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2}))

View solution in original post

matthewhaswell
Path Finder

We tried both and we continued to get events collated into bigger splunk events - i.e. 1 big splunk event that contains a random number of windows events together with no spacing between them. So no splitting on the time/date field.

However we found a solution with the help of a splunk tech, Guillaume:

I used the shotgun method of creating a props.conf in /etc/system/local
With: [source::WinEventLog:Application] LINE_BREAKER=([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2})) SHOULD_LINEMERGE=false

[source::WinEventLog:System] LINE_BREAKER=([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2})) SHOULD_LINEMERGE=false

[source::WinEventLog:...] LINE_BREAKER=([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2})) SHOULD_LINEMERGE=false

It works for system and application but not for WinEventLog:Directory Service and WinEventLog:DNS Server – so I presume the globbing ability of the ellipsis isn't grokked by the Splunk engine anymore too? (I apologise - it has been a long day).

Anyway - this should hold people until the patch.

0 Karma

zliu
Splunk Employee
Splunk Employee

In Splunk 4.1.x the LINE_BREAKER setting for the stanza [source::WinEventLog...] in the config $SPLUNK_HOME/etc/system/default/props.conf has been set to:

LINE_BREAKER =([\r\n](?=\d\d/\d\d/\d\d \d\d:\d\d:\d\d [aApPmM]{2}))

this changed to the following in 4.2:

LINE_BREAKER =([\r\n](?=\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [aApPmM]{2}))

Workaround:

LINE_BREAKER =([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2}))

Ellen
Splunk Employee
Splunk Employee

This known issue (SPL-38325) and targeted for a fix in 4.2.1

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...