https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90457#M18763 <P>after few investigations on my own , I have a more specific question.</P> <P>what is the correct way to configure props.conf in order to create an event per thread in the above example:</P> <P>event data=<BR /> "Attach Listener" daemon prio=3 tid=0x0000000007b28000 nid=0x14932 waiting on condition [0x0000000000000000]<BR /> java.lang.Thread.State: RUNNABLE</P> <P>and another event data =<BR /> "Transport1" daemon prio=3 tid=0x0000000009290000 nid=0x1493f runnable [0xfffffd7e83ebe000]<BR /> java.lang.Thread.State: RUNNABLE<BR /> at java.net.SocketInputStream.socketRead0(Native Method)<BR /> at java.net.SocketInputStream.read(SocketInputStream.java:129)<BR /> at jcifs.util.transport.Transport.readn(Transport.java:29)<BR /> at jcifs.smb.SmbTransport.peekKey(SmbTransport.java:366)<BR /> at jcifs.util.transport.Transport.loop(Transport.java:96)<BR /> at jcifs.util.transport.Transport.run(Transport.java:258)<BR /> at java.lang.Thread.run(Thread.java:619)</P> <P>the common denominator is all events start with " in the beginning of the line.<BR /> anyone with a quick regexp in props can help ?</P> Wed, 04 Jul 2012 08:44:35 GMT avishayh 2012-07-04T08:44:35Z https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90457#M18763 <P>after few investigations on my own , I have a more specific question.</P> <P>what is the correct way to configure props.conf in order to create an event per thread in the above example:</P> <P>event data=<BR /> "Attach Listener" daemon prio=3 tid=0x0000000007b28000 nid=0x14932 waiting on condition [0x0000000000000000]<BR /> java.lang.Thread.State: RUNNABLE</P> <P>and another event data =<BR /> "Transport1" daemon prio=3 tid=0x0000000009290000 nid=0x1493f runnable [0xfffffd7e83ebe000]<BR /> java.lang.Thread.State: RUNNABLE<BR /> at java.net.SocketInputStream.socketRead0(Native Method)<BR /> at java.net.SocketInputStream.read(SocketInputStream.java:129)<BR /> at jcifs.util.transport.Transport.readn(Transport.java:29)<BR /> at jcifs.smb.SmbTransport.peekKey(SmbTransport.java:366)<BR /> at jcifs.util.transport.Transport.loop(Transport.java:96)<BR /> at jcifs.util.transport.Transport.run(Transport.java:258)<BR /> at java.lang.Thread.run(Thread.java:619)</P> <P>the common denominator is all events start with " in the beginning of the line.<BR /> anyone with a quick regexp in props can help ?</P> Wed, 04 Jul 2012 08:44:35 GMT https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90457#M18763 avishayh 2012-07-04T08:44:35Z https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90458#M18764 <PRE><CODE>SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = ^" </CODE></PRE> Wed, 04 Jul 2012 08:47:47 GMT https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90458#M18764 Ayn 2012-07-04T08:47:47Z https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90459#M18765 <P>Tks, worked fine !!!!</P> Wed, 04 Jul 2012 08:58:12 GMT https://community.splunk.com/t5/Getting-Data-In/props-conf-regexp-help/m-p/90459#M18765 avishayh 2012-07-04T08:58:12Z