CODEWITHSUNDEEP
pythonpython-3.xsplunksplunk-dashboard
Anuj Sharma
Anuj Sharma

Reputation: 33

I want to get multiline logs in Splunk for my python service. How can I achieve that?

I have a python service which is integrated with the splunk for checking logs. I am getting getting error message in splunk in split lines like in image split line error. I want to get the error in the same line. How can I achieve that using logging?

Upvotes: 1

Views: 629

Answers (1)

RichG
RichG

Reputation: 9926

By default, every line of input to Splunk is considered a separate event. To change that, edit the props.conf file for the source type and change the LINE_BREAKER setting. Set the value to a regular expression that contains a capture group where one event ends and the next begins. I'd suggest such a regex, but can't do so without seeing more example data.

There are other props.conf settings you can use if LINE_BREAKER doesn't solve the problem. For instance, BREAK_ONLY_BEFORE, BREAK_ONLY_BEFORE_DATE, or MUST_BREAK_AFTER.

Upvotes: 2

Related Questions