We have updated our Terms of Service, Code of Conduct, and Addendum.

what is the equivalent of Splunk should_linemerge in Cribl?

Srinath Dayala
Srinath Dayala Posts: 12 ✭
in Stream

I am getting data into Cribl and it is by default breaking on each line (also when there is no timestamp). So, i have added manual event breaking based on timestamp. But it still the same behavior. Is there a way to disable line breaking on each line?

Tagged:

Answers

  • Srinath Dayala
    Srinath Dayala Posts: 12 ✭

    Also tried with regex event breaking. that also not working.

  • Jon Rust
    Jon Rust Posts: 458 mod

    If you can provide a sample of your event data structure, I might be able to provide an event breaker.

    Also, please review this blog and video

  • Srinath Dayala
    Srinath Dayala Posts: 12 ✭

    The data is coming to Cribl via Splunk forwarder and as it is cooked data, the event breaker settings are not working at Cribl side. Should be fixed on Splunk first.

  • Jon Rust
    Jon Rust Posts: 458 mod

    No necessarily. Cribl excels at manipulating your data. We can absolutely break the data in Cribl, and actually recommend it.

  • Srinath Dayala
    Srinath Dayala Posts: 12 ✭
    authentication.txt

    This sample data file onboarded to Cribl via Splunk UF and the data is parsed by default with each line as new event in Cribl. I don't want any breaking as it comes to Cribl.

  • Jon Rust
    Jon Rust Posts: 458 mod

    If you haven't already, please review the linked video and blog above.

    With only one event, I'm hoping this will work for you. Create this rule in a new Event Breaker ruleset. Save the rule, then the ruleset. Finally, apply it to your source. Once you commit and deploy, validate newly captured events show your new breaker in the cribl_breaker field.

    Cribl's event breaker rulesets are very flexible and powerful. Highly recommend you dig in on this topic.

    Filter: /^<authentication/.test(_raw)
    Event Breaker Type: Regex
    Event Breaker: [\r\n]+(?=<authentication)
    Timestamp: Current time (I do not see any timestamp in your sample data)

    image.png

Categories