Splunk Search

Splitting one event into multiple events

Branden
Builder

This should be a simple question. In fact, I've succeeded in doing this before, but I no longer have that app and I can't recall the solution.

I run a script that outputs something like the following:

Queue          Status
-----          ------
MTAB208A       READY
MTAB310C       READY
MTAB318A       READY
MTAB318B       READY

I want Splunk to alert me when the "READY" status changes to "DOWN" (or something other than "READY").

So I wrote a script that uses sed to remove the first two lines, so the output becomes:

MTAB208A       READY
MTAB310C       READY
MTAB318A       READY
MTAB318B       READY

I want Splunk to extract two fields: queue and status. This is easy enough except I want each of those queues to be its own event. Instead, I get one big event containing all four queues.

How do I get each of those queues to be its own event? I know there's an easy way to do this but I'm having a mind block here. (I suppose the other option is to do away with the sed trimming and use multikv, but I think that might over-complicate this.)

I tried using LINE_BREAKER in props.conf but that didn't do anything:

LINE_BREAKER = ^\w+\s+\w+

Update: Figured it out! I needed to use "MUST_BREAK_AFTER". Oh yeah, and bounce Splunk after updating props.conf.

Thanks!

Tags (1)
1 Solution

ziegfried
Influencer

You should split the events at index time by specifying something like this in your props.conf:

[your_sourcetype]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

View solution in original post

AmitKapila
New Member

I tried it after changing /opt/splunkforwarder/etc/apps/Metro_TA_iibcorp/local/props.conf but it fails again to split the EventType.

[metro:iibcorpqmon]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

Is the props .conf in the correct place?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@AmitKapila - This question is quite old and it may not garner the type of attention and activity that you seek. I would suggest posting a new question. Thank you.

0 Karma

ziegfried
Influencer

You should split the events at index time by specifying something like this in your props.conf:

[your_sourcetype]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = current
LINE_BREAKER=([\r\n]+)

Branden
Builder

Aaaah okay. I got it working with: MUST_BREAK_AFTER = ^\w+\s+\w+ Does that seem reasonable too? Thanks!

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...