https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132228#M27215 <P>Yes,I have tried but did not work.</P> Mon, 09 Feb 2015 02:25:48 GMT perlish 2015-02-09T02:25:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132222#M27209 <P>The first picture is my original logs<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/222i23CDCA6010BA8923/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>The second picture is my logs in the splunk<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/223iF104EB17D3DD2E98/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Now,we can see the splunk wrap my logs in the wrong places.<BR /> Please tell me how to set in the props.conf can solve this problem.<BR /> Thanks very much!</P> Fri, 06 Feb 2015 09:55:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132222#M27209 perlish 2015-02-06T09:55:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132223#M27210 <P>What are the current props.conf settings for this log? Have you tried <CODE>BREAK_ONLY_BEFORE=[ems.ton]</CODE>?</P> Fri, 06 Feb 2015 12:46:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132223#M27210 richgalloway 2015-02-06T12:46:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132224#M27211 <P>Hi perlish</P> <P>There seems to be two problems. First the output of your logs has unwanted carriage returns in it. The second splunk is not recognising this as a multiline event. The latter can be fixed with the following stanza in props.conf. The time prefix looks complex but it is saying look for a line that starts with [ and the time should come after the second [</P> <PRE><CODE>[business] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true TIME_PREFIX = ^\[[^\[]+\[ TIME_FORMAT = %Y-%m-%d %H:%M:%S,%q3 MAX_TIMESTAMP_LOOKAHEAD = 24 </CODE></PRE> <P>The line breaks will still be there and may cause fields to break in half. I suggest you look at how these logs are generated for the cause.</P> Fri, 06 Feb 2015 16:05:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132224#M27211 bmunson_splunk 2015-02-06T16:05:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132225#M27212 <P>Ignore the 5. before time format. I don't know where that came from.</P> Fri, 06 Feb 2015 16:10:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132225#M27212 bmunson_splunk 2015-02-06T16:10:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132226#M27213 <P>It's a line number added by the system in all code samples.</P> Fri, 06 Feb 2015 16:13:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132226#M27213 richgalloway 2015-02-06T16:13:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132227#M27214 <P>I tried this method but it seems did not work.<BR /> How can I set up the line breaker like a '\n'.</P> Mon, 09 Feb 2015 01:53:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132227#M27214 perlish 2015-02-09T01:53:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132228#M27215 <P>Yes,I have tried but did not work.</P> Mon, 09 Feb 2015 02:25:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132228#M27215 perlish 2015-02-09T02:25:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132229#M27216 <P>Hi,</P> <P>Try this,</P> <PRE><CODE>LINE_BREAKER = ([\r\n]+)\[[^\]]+\]\[\d{4}\-\d{2}\-\d{2}\s++\d{2}\:\d{2}\:\d{2}\,\d{3}\]\[tid\: </CODE></PRE> <P>THat should break the events better for you</P> Wed, 11 Feb 2015 13:46:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-a-correct-line-breaks-in-my-props-conf/m-p/132229#M27216 lmyrefelt 2015-02-11T13:46:25Z