Skip to main content

Explore Splunk Edge Processing

Interactive pipeline

SPLUNK HEC REFERENCE

Curated log-processing states

Stage 1 of 5

Authored log fixture

Inspect the synthetic application lines before any parse or retention policy is applied.

0HighlightsAuthored emphasis only—not a computed diff.
Copy & download

Input

2024-01-15 10:30:15 INFO  [main] Application started successfully2024-01-15 10:30:16 DEBUG [worker-1] Initializing connection pool2024-01-15 10:30:16 DEBUG [worker-1] Pool size: 10, timeout: 30s2024-01-15 10:30:17 WARN  [auth] Failed login attempt: user=admin ip=192.168.1.1002024-01-15 10:30:18 ERROR [db] Connection timeout to database server2024-01-15 10:30:19 DEBUG [health] Health check passed - all services OK

Output

2024-01-15 10:30:15 INFO  [main] Application started successfully2024-01-15 10:30:16 DEBUG [worker-1] Initializing connection pool2024-01-15 10:30:16 DEBUG [worker-1] Pool size: 10, timeout: 30s2024-01-15 10:30:17 WARN  [auth] Failed login attempt: user=admin ip=192.168.1.1002024-01-15 10:30:18 ERROR [db] Connection timeout to database server2024-01-15 10:30:19 DEBUG [health] Health check passed - all services OK
Stage configuration01-authored-log-fixture.yaml
input:
  file:
    paths: [ "/var/log/app/*.log" ]
    multiline:
      pattern: '^\d{4}-\d{2}-\d{2}'
      negate: true
      match: after