When ingesting Guardicore logs into Splunk. Multiple events are being combined into a single event. Date marks the beginning of a new event and I want to separate each event.
Sample Logs:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Origin: xxxxx-xxxxx-xxxx-1xxx-1xxxxxxxxxxxxx
Affected Agents: xxxxxxxxxx(ip: xx:x:xx:xxx, component_id: None)
Message: Agent installation of ‘xxxxxxxxxxx’ was successful
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Origin: Management
Affected Agents: xxxxxxxxx (ip: None, component_id: xxxxxxxxxx-xxxxx)
Message: Agent was removed upon expiry
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Origin: Management
Affected Agents:xxxxxxxxx (ip: xxxxxxxxxx, component_id: None),cccccccccccxxxxxxx (ip: xx:xx:xx:xxxx, component_id: None)Message: Received network event with unknown xxxxxx
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Expected outcome:
Event 1:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Origin: xxxxx-xxxxx-xxxx-1xxx-1xxxxxxxxxxxxx
Affected Agents: xxxxxxxxxx(ip: xx:x:xx:xxx, component_id: None)
Message: Agent installation of ‘xxxxxxxxxxx’ was successful
Event 2:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Origin: Management
Affected Agents: xxxxxxxxx (ip: None, component_id: xxxxxxxxxx-xxxxx)
Message: Agent was removed upon expiry
Event 3:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log
Origin: Management
Affected Agents:xxxxxxxxx (ip: xxxxxxxxxx, component_id: None),cccccccccccxxxxxxx (ip: xx:xx:xx:xxxx, component_id: None)Message: Received network event with unknown xxxxxx
props.conf
BREAK_ONLY_BEFORE_DATE = [true|false]
* When set to true, Splunk software creates a new event only if it encounters
a new line with a date.
* Note, when using DATETIME_CONFIG = CURRENT or NONE, this setting is not
meaningful, as timestamps are not identified.
* Defaults to true.
What's your props.conf
?