Splunk Search

How to regex events with "==========================" as event breaker?

kiran331
Builder

How to break the events with using regex with "==========================" as event breaker?

event:

PS C:\tetst\tethttb>
"ERROR: Parameter ""-ComputerName"" requires an argument."

Copyright (C) 2013 Microsoft Corporation. All rights reserved.

"ERROR: fd""-fgrgf"" requires an vcv."
Copyright (C) 2013 Microsoft gfg. All rights reserved.

BitLocker Drive Encryption: rTool version 10.0.rtret

"If the ""-cn"" parameter was specified, check that the computer name is correct."
interface.
ERROR: An error occurred while connecting to the BitLocker management
Computer Name: rtffggh
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

BitLocker Drive Encryption: Configuration Tool version 10.0.15063

Tags (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (^=+$)
DATETIME_CONFIG = none

This is the more efficient approach because it doesnt require the line merging processor and also instructs splunk to not try to parse a timestamp (which there are none in your sample data). Please note the = signs will be removed from the data too, effectively reducing license spend.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (^=+$)
DATETIME_CONFIG = none

This is the more efficient approach because it doesnt require the line merging processor and also instructs splunk to not try to parse a timestamp (which there are none in your sample data). Please note the = signs will be removed from the data too, effectively reducing license spend.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kiran331,
in props.conf put

[your_sourcetype]
BREAK_ONLY_BEFORE = \={5,100}

Bye.
Giuseppe

landen99
Motivator

And: SHOULD_LINEMERGE = true. And unless more than 100 "=" is a deal breaker, you might as well just let it stop at 5:

[your_sourcetype]
BREAK_ONLY_BEFORE = \={5}
SHOULD_LINEMERGE = true
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@cusello, @landen99 - how does that map in the case that there might be some comment somewhere that happened to have ===== in the middle of a line?

Would you use ^={5,}, or is ^ not meaningful as start of line in BREAK_ONLY_BEFORE?

0 Karma

landen99
Motivator

jcat54's answer is much better. I learned something big from that answer; wish I had understood that a while ago. Also, you are correct that any comment with an equals sign in it 5 times would initiate an event break right before that line. I neglected the "^" because I suspected that some events might have space characters before the "=". I neglected matching more than 5 because once a match of 5 was complete, the rest didn't matter.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...