Splunk Search

Merge multiple line to one line with end, start line desire?

nnips
Engager

Hi, I'm have trouble with multiple line in my logs and i have many information dont need in this logs.
So I'm want get some information in this log with start line and end line. Anyone have idea for this ?
Example:

Oracle Database 10g Release 
CPU:
RAM:

Thu Apr 12 12:00:00 2012
LENGTH : '111'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[5] 'pts/1'
STATUS:[1] '0

=> Results:

Thu Apr 12 12:00:00 2012
LENGTH : '111'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[5] 'pts/1'
STATUS:[1] '0

=> Somthing dont need:

Oracle Database 10g Release 
CPU:
RAM:
0 Karma

p_gurav
Champion

Hi

Can you try to add HEADER_FIELD_LINE_NUMBER like this in props.conf:

[your_sourcetype]
HEADER_FIELD_LINE_NUMBER = 4
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...