Getting Data In

how to remove multiple logs into single event

duggp007
New Member

[tomcat]
EXTRACT = \/u01\/logs-(?\w+)\/.* in source

Adding the below to BREAK EVENTS only at timestamp and TRUNCATING issue

BREAK_ONLY_BEFORE = (\d+[- :,-w]+)
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 0

We are facing an issue with multiple logs in a single event for only tomcat as the sourcetype,

May I know the reason for it.
we also have
SHOULD_LINEMERGE=true for other sourcetype should I include SHOULD_LINEMERGE=false for the tomcat.

Any help will be appreciated.

0 Karma

woodcock
Esteemed Legend

You should always avoid the BREAK_* settings and use only SHOULD_LINEMERGE=false and LINE_BREAKER = Your RegEx Here.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI duggp007,
surely you have to review your parsing.
To do this I suggest to take an extract of your logs with all the kind of logs in the same sourcetype (e.g. tomcat) in a text file.
Then ingest it for test using the guided procedure in web interface [Settings -- Add Data] so you can find the correct options yo use for thst sourcetype.
Probably is uncorrect the TIME_PREFIX and/or the TIME_FORMAT, so, sometimes, Splunk cannot recognize the start of an event and doesn't correctly break it.

Bye.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your line breaking settings in props.conf are wrong. We'll need to see some sample data to give the best settings.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...