Getting Data In

How to write Linebreaker rule for the below events?

lksridhar
Explorer

Hi Team,

We have ingested the NSG flow logs from azure and few events are not breaking the events properly, could you please help me to write the LINE_BREAKER rule for below events.

Sample events:

"time":"2018-05-30T16:07:43.6682050Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","12000,T,O,A"]}]}]}{"time":"2018-05-30T16:06:43.6499999Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","resourceId":"/,T,O,A"]}]}]}{"time":"2018-05-30T16:06:43.6499999Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","resourceId":"/,T,O,A"]}]}]}

LINE_BREAKER=?

Tags (2)
0 Karma
1 Solution

niketn
Legend

@lksridhar, can you try with this?

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

dpetracca_splun
Splunk Employee
Splunk Employee

hey guys, sorry for making my comment an answer. For some reason, it won't allow me to make comments, only answers.... ???
When I click on "comment" it drops down to the main answers section.

0 Karma

dpetracca_splun
Splunk Employee
Splunk Employee

@niketnilay, no your 29 is correct, I wasn't looking at timezone. Was more focused on the line break actually.

lksridhar
Explorer

Thanks nikentilay and dpetracca for your input. i tried nikentilay command it is working for me.

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29

Thanks for helping to fix the issue.

dpetracca_splun
Splunk Employee
Splunk Employee

I came to same conclusion as @niketn
I tested it out and here is the props.conf that works:

[test_line_break]
DATETIME_CONFIG =
LINE_BREAKER = (]}]}]})
MAX_TIMESTAMP_LOOKAHEAD = 27
NO_BINARY_CHECK = true
TIME_PREFIX = time
category = Custom
disabled = false
pulldown_type = true

niketn
Legend

@dpetracca I had MAX_TIMESTAMP_LOOKAHEAD as 29 to extract even the timezone. Are you planning to apply TIMESTAMP_FORMAT %6N and stop Timestamp extraction?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you missing a curly bracket in the line 1??

0 Karma

niketn
Legend

@lksridhar, can you try with this?

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@lksridhar, great to hear that your issue is resolved. I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...