Getting Data In

Why is event breaking working on the output of a script (input/file), but not on the script output itself (input/script)?

crash1011
Explorer

I have created a script below that will simulate exactly what I'm experiencing.

If I redirect the script's output to a file and monitor that with the following sourcetype in props.conf, it event breaks all OK.
If I use exactly the same sourcetype for the input/script everything works, however, I never get to see Fan 2!?
I've tried various types of LINE_BREAK/LINE MERGE/MAX_EVENTS to get it work with no success, although, I must have missed the magic combination...

props.conf

[macos:fanspeed]
PREAMBLE_REGEX = (Total fans in system:\s.)
BREAK_ONLY_BEFORE = ()Fan #[0|1|2]:
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = true
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
description = Extract fan speed
disabled = false

getFanSpeedSim.sh

cat <<EOF
Total fans in system: 3

Fan #0:
    Actual speed : 998
    Minimum speed: 1000
    Maximum speed: 4600
    Safe speed   : 0
    Target speed : 1000
    Mode         : auto

Fan #1:
    Actual speed : 1329
    Minimum speed: 1200
    Maximum speed: 5500
    Safe speed   : 0
    Target speed : 1200
    Mode         : auto

Fan #2:
    Actual speed : 1199
    Minimum speed: 1200
    Maximum speed: 3500
    Safe speed   : 0
    Target speed : 1200
    Mode         : auto
EOF

Thanks in advance!

0 Karma

jtrujillo
Path Finder

Why not just back it up to before the number? Or try a range?

BREAK_ONLY_BEFORE = ()Fan #:

-OR-

BREAK_ONLY_BEFORE = ()Fan #[0-3]:

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...