https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317179#M37982 <P>as you see above sample log, ı coundn't parse after "msg=" How to seperate this log to 3 logs </P> Wed, 20 Sep 2017 07:08:10 GMT gizemk00 2017-09-20T07:08:10Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317177#M37980 <P>We changed UseLegacySyslogFormat as No and then log size not changed. How do we add the changed dbparm to the props.conf? as text or whatelse??</P> <P>&lt;5&gt;1 2017-09-08T15:30:51Z CAVAULT01 CEF:0|Cyber-Ark|Vault|9.81.0000|241|Prepare Backup Metadata|5|act="Prepare Backup Metadata" suser=***** fname= dvc= shost=***** dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2= cs3Label="Device Type" cs3= cs4Label="Database" cs4= cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2= msg=&lt;5&gt;1 2017-09-08T15:30:51Z CAVAULT01 CEF:0|Cyber-Ark|Vault|9.81.0000|236|Backup Metadata|5|act="Backup Metadata" suser=***** fname= dvc= shost=***** dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2= cs3Label="Device Type" cs3= cs4Label="Database" cs4= cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2= msg=&lt;5&gt;1 2017-09-08T15:30:51Z CAVAULT01 CEF:0|Cyber-Ark|Vault|9.81.0000|236|Backup Metadata|5|act="Backup Metadata" suser=***** fname= dvc= shost=******* dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2= cs3Label="Device Type" cs3= cs4Label="Database" cs4= cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2= msg= </P> Tue, 05 Sep 2017 05:35:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317177#M37980 gizemk00 2017-09-05T05:35:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317178#M37981 <P>Please explain with more words and maybe show the changes and the data; I do not at all understand what you are saying.</P> Sun, 10 Sep 2017 17:41:20 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317178#M37981 woodcock 2017-09-10T17:41:20Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317179#M37982 <P>as you see above sample log, ı coundn't parse after "msg=" How to seperate this log to 3 logs </P> Wed, 20 Sep 2017 07:08:10 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317179#M37982 gizemk00 2017-09-20T07:08:10Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317180#M37983 <P>I can see above sample you paste is multiple messages (with msg present correctly in 1st message), and event starting at YYYY-MM-DDTHH:mm:ss (eg 2017-09-08T15:30:51Z) but not on \r\n . So ensure your props.conf have correct time_format so it break on time rather on new-line.</P> <P>Something like below would do</P> <PRE><CODE>[yoursourcetype] MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%dT%H:%M:%S TIME_PREFIX = ^ </CODE></PRE> <P>Or try ( i haven't tried it before)<BR /> BREAK_ONLY_BEFORE_DATE </P> <P>A more detailed set of <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Configureeventlinebreaking" target="_blank">examples/documentation in here</A></P> Tue, 29 Sep 2020 15:53:41 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317180#M37983 koshyk 2020-09-29T15:53:41Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317181#M37984 <P>thank you for comment, we used LINE_BREAKER = ([\r\n ]+) format, also this method worked, event starting at \r\n as &lt; 5 &gt; 1 but when ı copy, it remove</P> Wed, 20 Sep 2017 12:34:38 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-the-Splunk-Add-on-for-CyberArk-logs-in-the-correct/m-p/317181#M37984 gizemk00 2017-09-20T12:34:38Z