Getting Data In

Why does Splunk sometimes insert the a blank line in forwarded log4net logs?

rajeevmcaiomedi
New Member

I have the following log punch by log4net

DATE   :   02-10-2015 05:06:37
URL    :   http://localhost/229/processType/BY
TYPE   :   ERROR 
DETAILS:
System.Exception: Max TM connection failed, StatusCode:Accepted ,MaxAttempt:21

But by using forwarder i am getting the following log punch on indexer

DATE   :   02-10-2015 05:06:37
URL    :   http://localhost/229/processType/BY
TYPE   :   ERROR 
DETAILS:

System.Exception: Max TM connection failed, StatusCode:Accepted ,MaxAttempt:21

one extra space is included under Details which search does not process for "Max TM connection failed". and no line break i.e ------------
included in the indexer log. This is happening on some events, not all events.

Can you please let me know why this issue arises and what is the workaround for this?

0 Karma

lmyrefelt
Builder

You could open your look file (the source) in some good text-editor like notepad++ and check for line breaks , character returns and other "hidden" stuff , to make sure the source is not appending anything Splunk breaks or splits events on .. i have not seen splunk adding stuff by it selfs

0 Karma

lmyrefelt
Builder

Hi,

I would have tried to configure LINE_BREAKER in props.conf for the source type . I have earlier had success with this in similar events / problems. By configure the line_breaker you say to splunk not break your events on standard new-line, break och what ever ... which might be the case.

example
LINE_BREAKER = ([\r\n]+)DATE\s++:\s++\d{2}-\d{2}-\d{4}

LINE_BREAKER = ([\r\n]+)DATE\s++\:\s++\d{2}\-\d{2}\-\d{4}
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...