Hi Team,
Currently we have the logs getting indexed into Splunk in this format but we require that each line has to be indexed separately in Splunk.
Current Logs getting indexed in Splunk as a single event:
12:47:33,982 INFO [stdout] (default-threads - 14) Token Service Started : 1508762853982
12:47:34,044 INFO [stdout] (default-threads - 14) Token Service Ended : 1508762854044
12:47:34,107 INFO [stdout] (SwingWorker) Progress: 1 - Caching definition from url [file:///merrill/PDF/DataSiteDocumentProcessing.wsdl]
12:47:34,107 INFO [stdout] (SwingWorker) Progress: 1 - Loading definition from cache
12:47:34,107 DEBUG [com.eviware.soapui.impl.wsdl.support.wsdl.WsdlContext] (SwingWorker) Loading definition from cache
12:47:34,107 DEBUG [com.eviware.soapui.impl.wsdl.support.wsdl.WsdlLoader] (SwingWorker) Returning baseInputSource [file:///merrill/PDF/DataSiteDocumentProcessing.wsdl]
12:47:34,107 INFO [stdout] (SwingWorker) Retrieving document at 'file:///merrill/PDF/DataSiteDocumentProcessing.wsdl'.
12:47:34,107 DEBUG [com.eviware.soapui.impl.wsdl.support.wsdl.WsdlContext] (SwingWorker) Loaded definition: ok
12:47:34,107 INFO [com.eviware.soapui.impl.wsdl.support.xsd.SchemaUtils] (SwingWorker) Loading schema types from [file:///merrill/PDF/DataSiteDocumentProcessing.wsdl]
12:47:34,107 INFO [com.eviware.soapui.impl.wsdl.support.xsd.SchemaUtils] (SwingWorker) Getting schema file:///merrill/PDF/DataSiteDocumentProcessing.wsdl
12:47:34,138 INFO [com.eviware.soapui.impl.wsdl.support.wsdl.WsdlImporter] (default-threads - 14) Finding importer for {http://webservice.datasite.merrillcorp.com/}DocumentProcessingWSServiceSoapBinding
12:47:34,138 INFO [com.eviware.soapui.impl.wsdl.support.wsdl.WsdlImporter] (default-threads - 14) Importing binding {http://webservice.datasite.merrillcorp.com/}DocumentProcessingWSServiceSoapBinding
12:47:34,138 INFO [com.eviware.soapui.impl.wsdl.support.soap.Soap11HttpBindingImporter] (default-threads - 14) importing endpoint http://localhost:9090/DocumentProcessingWSPort
12:47:34,138 INFO [com.eviware.soapui.impl.wsdl.support.soap.Soap11HttpBindingImporter] (default-threads - 14) importing operation availableDocument
12:47:34,138 INFO [com.eviware.soapui.impl.wsdl.support.soap.Soap11HttpBindingImporter] (default-threads - 14) importing operation recordEvent
12:47:34,138 INFO [com.eviware.soapui.impl.wsdl.support.soap.Soap11HttpBindingImporter] (default-threads - 14) importing operation returnProcessedDocument
I have also tried with props.conf with the server name as sourcetpye but it didnt picked up so need your help to solve this issue so that each and every line would be single event in Splunk.
props.conf which I have tried with server name starting with eu2pdsaem and eu3pdsaem
[host::eu2pdsaem*]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
[host::eu3pdsaem*]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
But this didnt worked and hence once again we are getting all lines as a single event so kindly let me know the exact props.conf also how to monitor the same with the servername instead of sourcetype.
↧