Getting Data In

How do I line break this data source?

BlakeDC
New Member
ComputerTarget=EDITED; NeededCount=31; DownloadedCount=0; NotApplicableCount=82225; NotInstalledCount=31; InstalledCount=32; FailedCount=0
ComputerTarget=EDITED; NeededCount=202; DownloadedCount=0; NotApplicableCount=81555; NotInstalledCount=202; InstalledCount=154; FailedCount=0
ComputerTarget=EDITED; NeededCount=203; DownloadedCount=0; NotApplicableCount=81921; NotInstalledCount=203; InstalledCount=156; FailedCount=0

This is my data source. I have it setup in props.conf to linebreak after FailedCount=####### but it doesn't seem to be working (data never reaches Splunk unless I remove the props settings).

Here's my props:

[NeededCount]
CHARSET = UTF-16LE
is_valid = True
SHOULD_LINEMERGE = True
MUST_BREAK_AFTER = (FailedCount=\d{1,10})

I need help in making sure it'll break after that failedcount=#### so that each line shows up in Splunk as its own event and not just a giant event of 130+ lines.

Tags (2)
0 Karma

mosman_splunk
Splunk Employee
Splunk Employee

LINE_BREAKER=(FailedCount=\d+)\s+ComputerTarget
SHOULD_LINEMERGE = false

Good luck

0 Karma

ltawfall
Path Finder

Does the file have newlines?

LINE_BREAKER=([\r\n]+)
SHOULD_LINEMERGE = false

generally works.

0 Karma

BlakeDC
New Member

It's a powershell output to a file. It's basically all the lines at once.

I've tried to default which you pasted above but when I do that no data is showing up in splunk 😞

0 Karma

BlakeDC
New Member

I added a "`n" to the end of the output file so each line now has a hard break inserted. It shows up now but it's still just one single event instead of an event for each line 😞

It basically thinks I have 300 fields in this log and I can't parse!

0 Karma

ltawfall
Path Finder

bah.. I need to actual output file to to get this correctly. I've had to do a lot of weird line parsing lately, so it's fresh in the brain.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...