Splunk Search

How to regex events with "==========================" as event breaker?

kiran331
Builder

How to break the events with using regex with "==========================" as event breaker?

event:

PS C:\tetst\tethttb>
"ERROR: Parameter ""-ComputerName"" requires an argument."

Copyright (C) 2013 Microsoft Corporation. All rights reserved.

"ERROR: fd""-fgrgf"" requires an vcv."
Copyright (C) 2013 Microsoft gfg. All rights reserved.

BitLocker Drive Encryption: rTool version 10.0.rtret

"If the ""-cn"" parameter was specified, check that the computer name is correct."
interface.
ERROR: An error occurred while connecting to the BitLocker management
Computer Name: rtffggh
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

BitLocker Drive Encryption: Configuration Tool version 10.0.15063

Tags (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (^=+$)
DATETIME_CONFIG = none

This is the more efficient approach because it doesnt require the line merging processor and also instructs splunk to not try to parse a timestamp (which there are none in your sample data). Please note the = signs will be removed from the data too, effectively reducing license spend.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (^=+$)
DATETIME_CONFIG = none

This is the more efficient approach because it doesnt require the line merging processor and also instructs splunk to not try to parse a timestamp (which there are none in your sample data). Please note the = signs will be removed from the data too, effectively reducing license spend.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kiran331,
in props.conf put

[your_sourcetype]
BREAK_ONLY_BEFORE = \={5,100}

Bye.
Giuseppe

landen99
Motivator

And: SHOULD_LINEMERGE = true. And unless more than 100 "=" is a deal breaker, you might as well just let it stop at 5:

[your_sourcetype]
BREAK_ONLY_BEFORE = \={5}
SHOULD_LINEMERGE = true
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@cusello, @landen99 - how does that map in the case that there might be some comment somewhere that happened to have ===== in the middle of a line?

Would you use ^={5,}, or is ^ not meaningful as start of line in BREAK_ONLY_BEFORE?

0 Karma

landen99
Motivator

jcat54's answer is much better. I learned something big from that answer; wish I had understood that a while ago. Also, you are correct that any comment with an equals sign in it 5 times would initiate an event break right before that line. I neglected the "^" because I suspected that some events might have space characters before the "=". I neglected matching more than 5 because once a match of 5 was complete, the rest didn't matter.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...