Getting Data In

how to split a log file which contain multiple KPI information as many individual events using the delimiter "==========="?

senthamilselvan
Engager

[Pra] KPI_DB_001: Transactions per sec

Detailed breakdown of processing time % Total

***********************************************
Total processing 100 14566023932

Section execution

TOTAL_SECTION_PROC_TIME 3 575697340

TOTAL_SECTION_SORT_PROC_TIME 0 3809

[Pra] KPI_DB_005 Buffer pool hit ratio.

Type Ratio Formula


Data 9 (1-(16829502+6813417-15031035)/(3417808829+576
Index 99 (1-(4308509+1968-191493)/(6726500833+356522))

================================================================================

[Pra] KPI_DB_007

Per activity                    Total                                      (micro sec or nano sec ?)                  

LOCK_WAIT_TIME 0 2131581

LOCK_WAITS 0 547

================================================================================

[Pra] KPI_DB_006

Row processing
ROWS_READ/ROWS_RETURNED = 3325 (292223944055/87871120)

================================================================================

i want each kpi as individual event while importing my log file, please help me 🙂

Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI senthamilselvanj,
did you tried to insert in your props.conf something like the following configuration?

[ your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\[Pra\]\s+KPI

Bye.
Giuseppe

0 Karma

senthamilselvan
Engager

Hi Giuseppe,

Thank you for the replay, I tried but the syntax is not working as expected. Please find the below detailed info.
The below is my sample log files. All the information will come as single log file and i want to breaks this as separate events based on the delimiter "=====" . which is coming along with the log file.

Monitoring report - database summary

Database: DQA01CDW

Generated: 08/16/2017 11:03:38

Interval monitored: 900

Transactions per sec
ACT_COMPLETED_TOTAL 2760Pra 2484587[Pra] TPS cumulative value for last 900 sec

Component times

-- Detailed breakdown of processing time --

                                  %                 Total                     
                                  ----------------  --------------------------

Total processing 100 14566023932

Buffer pool hit ratio. This KPI is captured based on type, we can include Data, Index, XDA, COL. Formula is nice to have
Buffer pool


Buffer pool hit ratios

Type Ratio Formula


Data 9Pra (1-(16829502+6813417-15031035)/(3417808829+576

I tried using the below props.config file to split the logs
[dbmonitoring]
BREAK_ONLY_BEFORE = [=]+
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
category = Application
pulldown_type = true

But still events are not separated as expected based on delimiter.

Thanks
selvan

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...