https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118268#M24558 <P>I've got windows FTP logs that are multiline that look like:</P> <PRE><CODE>00:00:10 127.0.0.1 [57708]USER 123456 331 0 0 0 0 FTP 00:00:11 127.0.0.1 [57708]PASS - 230 0 0 0 1078 FTP 00:00:11 127.0.0.1 [57708]created /test.txt 226 0 0 11051 94 FTP 00:00:11 127.0.0.1 [57708]QUIT - 226 0 0 0 0 FTP 00:00:57 127.0.0.1 [57728]USER 123456 331 0 0 0 0 FTP 00:00:58 127.0.0.1 [57728]PASS - 230 0 0 0 1532 FTP 00:00:58 127.0.0.1 [57728]CWD inbox 250 0 0 0 0 FTP 00:00:58 127.0.0.1 [57728]CWD ~ 250 0 0 0 0 FTP 00:00:59 127.0.0.1 [57728]CWD / 250 0 0 0 16 FTP 00:00:59 127.0.0.1 [57728]QUIT - 250 0 0 0 0 FTP </CODE></PRE> <P>the bracketed number is like the session ID so i want to group all of those as 1 event. I tried linebreaking my props.conf with the following but it doesn't seem to be working. It's indexing around 200 lines (multiple session IDs) as one event.</P> <PRE><CODE>[sourcetype] SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = (\d\d:\d\d:\d\d .* \w\[\d+\]USER) </CODE></PRE> Tue, 03 Feb 2015 15:57:11 GMT ngvella 2015-02-03T15:57:11Z https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118268#M24558 <P>I've got windows FTP logs that are multiline that look like:</P> <PRE><CODE>00:00:10 127.0.0.1 [57708]USER 123456 331 0 0 0 0 FTP 00:00:11 127.0.0.1 [57708]PASS - 230 0 0 0 1078 FTP 00:00:11 127.0.0.1 [57708]created /test.txt 226 0 0 11051 94 FTP 00:00:11 127.0.0.1 [57708]QUIT - 226 0 0 0 0 FTP 00:00:57 127.0.0.1 [57728]USER 123456 331 0 0 0 0 FTP 00:00:58 127.0.0.1 [57728]PASS - 230 0 0 0 1532 FTP 00:00:58 127.0.0.1 [57728]CWD inbox 250 0 0 0 0 FTP 00:00:58 127.0.0.1 [57728]CWD ~ 250 0 0 0 0 FTP 00:00:59 127.0.0.1 [57728]CWD / 250 0 0 0 16 FTP 00:00:59 127.0.0.1 [57728]QUIT - 250 0 0 0 0 FTP </CODE></PRE> <P>the bracketed number is like the session ID so i want to group all of those as 1 event. I tried linebreaking my props.conf with the following but it doesn't seem to be working. It's indexing around 200 lines (multiple session IDs) as one event.</P> <PRE><CODE>[sourcetype] SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = (\d\d:\d\d:\d\d .* \w\[\d+\]USER) </CODE></PRE> Tue, 03 Feb 2015 15:57:11 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118268#M24558 ngvella 2015-02-03T15:57:11Z https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118269#M24559 <P>The <CODE>\w</CODE> in the BREAK_ONLY_BEFORE line appears to be causing matches to fail.</P> Mon, 28 Sep 2020 18:46:35 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118269#M24559 richgalloway 2020-09-28T18:46:35Z https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118270#M24560 <P>Yeah i tested the regex out and it was definitely wrong, but i changed it to remove the \w and it's still indexing 257 lines per event.</P> Tue, 03 Feb 2015 18:14:20 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-FTP-log/m-p/118270#M24560 ngvella 2015-02-03T18:14:20Z