Hello All,
After uploading Windows Active Directory data from file '.log' to SPLUNK, i recognized that all data is not parsed.
To be honest- data looks like trash 😕 (imported as a one big row_event)
Any advice how to parse data from log file to let's say format readable from SPLUNK?
Maybe you know some scripts or any other way to parse file with extension '.log' to SPLUNK.
thanks in advance,
Mateusz
Somebody probably redefined LINE_BREAKER
in the global props.conf
file (either $SPLUNK_HOME/etc/system/default/
or ${SPLUNK_HOME}/etc/system/local/
). The right thing to do is to move his global-context configuration changes to an app (context) and then your stuff (and others in the future) will work as they should right out of the box. Short of that, create an app for your stuff (which you should really do anyway in $SPLUNK_HOME/etc/MyApp/default/props.conf
) and put this line in it:
LINE_BREAKER = ([\r\n]+)
Read up on all this here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents
Somebody probably redefined LINE_BREAKER
in the global props.conf
file (either $SPLUNK_HOME/etc/system/default/
or ${SPLUNK_HOME}/etc/system/local/
). The right thing to do is to move his global-context configuration changes to an app (context) and then your stuff (and others in the future) will work as they should right out of the box. Short of that, create an app for your stuff (which you should really do anyway in $SPLUNK_HOME/etc/MyApp/default/props.conf
) and put this line in it:
LINE_BREAKER = ([\r\n]+)
Read up on all this here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents
Thanks for answer - I'm going to check this and give back information.