How to break events on timestamp?

splunkN00b — Wed, 17 Jan 2024 17:02:22 GMT

Events are merging like this:

2022-02-02T15:26:46.593150-05:00 mycompany: syslog initialised2022-02-02T15:26:48.970328-05:00 mycompany: [Portal|SYSTEM|20001|*system] Portal is starting2022-02-02T15:26:50.032387-05:00 mycompany: [Portal|SYSTEM|20002|*system] Portal is up and running2022-02-02T15:26:50.488943-05:00 mycompany: [Portal|CONTENTMANAGER|20942|-] Created fields (category), uid=5fdc6ec-01f0-41d5-8a33-d58b5efre2022-02-02T15:26:50.496126-05:00 mycompany: [Portal|CONTENTMANAGER|20942|-] Created fields (category), uid=6fe48c-20ee-4f7b-bf88-22ed5dfdd2022-02-02T15:26:50.502563-05:00 mycompany: [Portal|CONTENTMANAGER|20942|-] Created fields (category), uid=bcd5c461-9d23-4c79-8509-4af76c03ff5a2022-02-02T15:26:50.505764-05:00 mycompany: [Portal|CONTENTMANAGER|20942|-] Created fields (category), uid=bbb9449e-2893-4d06-bc51-edfdd42022-02-02T15:26:50.512171-05:00 mycompany: [Portal|CONTENTMANAGER|20942|-] Created fields (category), uid=155c7a37-69bc-44d2-98ac-cb75831a7c472022-02-02T15:26:50.517049-05:00 mycompany: [Portal|CONTENTMANAGER|20942|-] Created fields (category), uid=a575dfde3eb-4ca6-be2d-4491a4b59fe02022-02-02T15:33:33.669982-05:00 mycompany: syslog initialised2022-02-02T15:33:40.935228-05:00 mycompany: [Portal|SYSTEM|20001|*system] Portal is starting2022-02-02T15:33:41.990171-05:00 mycompany: [Portal|SYSTEM|20002|*system] Portal is up and running2022-02-02T15:35:34.533063-05:00 mycompany: syslog initialised2022-02-02T15:35:42.168799-05:00 mycompany: [Portal|SYSTEM|20001

I am expecting logs should break on timestamps like this:

2022-02-02T15:26:46.593150-05:00 mycompany: syslog initialised

2022-02-02T15:26:48.970328-05:00 mycompany: [Portal|SYSTEM|20001|*system] Portal is starting

2022-02-02T15:26:50.032387-05:00 mycompany: [Portal|SYSTEM|20002|*system] Portal is up and running

Re: How to break events on timestamp?

richgalloway — Wed, 17 Jan 2024 19:01:12 GMT

It would help to see the props.conf settings for that sourcetype, but these should get you started:

[mysourcetype] LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d\d\dT EVENT_BREAKER = ([\r\n]+)\d\d\d\d-\d\d\d\dT EVENT_BREAKER_ENABLE = true SHOULD_LINEMERGE = false TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z MAX_TIMESTAMP_LOOKAHEAD = 30 TRUNCATE = 10000

Re: How to break events on timestamp?

inventsekar — Thu, 18 Jan 2024 01:45:51 GMT

Hi @splunkN00b

Pls copy paste the props.conf .. something got messaged up there..

Pls provide us some more details.. may we know what logs are these..

did you upload the logs manually or do you read these logs thru UF

topic Re: How to break events on timestamp? in Getting Data In

How to break events on timestamp?

Re: How to break events on timestamp?

Re: How to break events on timestamp?