All Apps and Add-ons

Alert Manager: How to prevent long comments (with new line) from being split into multiple events?

americob
Explorer

While testing comments, I've found that when we entered a long comment (copied a 219 word / 2 paragraph text fromhttp://lipsum.com/feed/html ) they are split into 3 events. The first event has the fields time, serverity, origin, event_id, user, action, incident_id, comment. The comment is split so the second paragraph is located in a second event (no fields) and the 3rd event has only the closing quotes.

Thanks,
Americo

Tags (2)
0 Karma
1 Solution

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

View solution in original post

Simon
Contributor

Thanks for the report. I confirm that this is a bug. I'll have a look and provide a workaround and a solution in the source code.
By the way, I opened a bug report at GitHub:
https://github.com/simcen/alert_manager/issues/131

0 Karma

Azeemering
Builder

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...