All Apps and Add-ons

Single Event vs. multi-events for scripted inputs

mikelanghorst
Motivator

Previously the scripted inputs (source=cpu, source=netstat, etc) all created a single event per run. Recently however I noticed the openports (was probably that way for awhile) creates an event per line of output.

Why the differences? Just trying to understand the reason behind one vs. the other.

1 Solution

yannK
Splunk Employee
Splunk Employee

This is not new.
The props.conf config in older and current versions calls for a single line per event.

in unix app 4.6

[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
REPORT-fields_for_cpu_sh = fields_for_cpu_sh

in unix app 5.0.0
`
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi
FIELDALIAS-dest_for_cpu = host as dest
FIELDALIAS-src_for_cpu = host as src
FIELDALIAS-cpu_for_cpu = CPU as cpu
FIELDALIAS-idle_time_for_cpu = pctIdle AS PercentIdleTime
FIELDALIAS-nice_time_for_cpu = pctNice AS PercentNiceTime
FIELDALIAS-cpu_load_percent_for_cpu = pctSystem AS PercentSystemTime,pctSystem as cpu_load_percent
FIELDALIAS-cpu_user_percent_for_cpu = pctUser AS PercentUserTime,pctUser as cpu_user_percent
FIELDALIAS-wait_time_for_cpu = pctIowait AS PercentWaitTime

`

View solution in original post

yannK
Splunk Employee
Splunk Employee

This is not new.
The props.conf config in older and current versions calls for a single line per event.

in unix app 4.6

[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
REPORT-fields_for_cpu_sh = fields_for_cpu_sh

in unix app 5.0.0
`
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi
FIELDALIAS-dest_for_cpu = host as dest
FIELDALIAS-src_for_cpu = host as src
FIELDALIAS-cpu_for_cpu = CPU as cpu
FIELDALIAS-idle_time_for_cpu = pctIdle AS PercentIdleTime
FIELDALIAS-nice_time_for_cpu = pctNice AS PercentNiceTime
FIELDALIAS-cpu_load_percent_for_cpu = pctSystem AS PercentSystemTime,pctSystem as cpu_load_percent
FIELDALIAS-cpu_user_percent_for_cpu = pctUser AS PercentUserTime,pctUser as cpu_user_percent
FIELDALIAS-wait_time_for_cpu = pctIowait AS PercentWaitTime

`

mikelanghorst
Motivator

Though I've not updated to the TA for my *nix inputs yet, will roll that into my 6.0 upgrade.

0 Karma

mikelanghorst
Motivator

Odd, source=cpu is still showing up as a single event for me. But the question was more "why the change", it kinda made sense to have one event as it's a snapshot in time, but yea always having to "| multikv" is a pain. Just trying to understand the reasoning, to mirror the functionality on my own inputs.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...