multi-timestamps/multi-line help

a212830 — Mon, 28 Sep 2020 15:47:12 GMT

Hi,

I have a multi-line feed with two diffferent timestamp formats? How would I handle that? The formats are very similiar, but one starts with an @. I was thinking a regex for the TIME_PREFIX and setting BREAK_ONLY_BEFORE_DATE = true. I need help with the regex for the TIME_PREFIX though...

16:20:33.619 Trc 04541 RequestQueryLocation received from 29
message RequestQueryLocation
AttributeReferenceID 193380
AttributeLocation 'MMK_SIPS_Branch'
AttributeLocationInfoType 0
@16:20:33.6196 [ISCC] Message EventLocationInfo [Event (To Client):00033fd7] is enqueued
@16:20:33.6387 [ISCC] Message EventLocationInfo [Event (To Client):00033fd7] is dequeued
@16:20:33.6387 [0] 8.1.101.01 send_to_client: message EventLocationInfo
AttributeEventSequenceNumber 00000000000347bd
AttributeTimeinuSecs 638707
AttributeTimeinSecs 1391203233 (16:20:33)
AttributeExtensions [439] 00 01 03 00..
'LQ-location-0'(list) 'LQ-location-name' 'MMK_SIPS_CC'
'LQ-location-status' 1
'LQ-link-status' 1
'LQ-capability-mask' bin: ff ff ff fe.. (len=64)
'LQ-extended-capabilities' '(2=(56=396273),8=(16=7),10=(16=15),11=(16=25),14=(73=1),34=(67=3),36=(60=131),75=(16=1),76=(16=25),108=(74=2),113=(83=132604),160=(146=1),161=(146=1),162=(146=1))'
'LQ-version' '8.1.101.01'
'LQ-tscp-version' '8.1.010.46'
AttributeReferenceID 193380
AttributeLocationInfoType 0
16:20:33.638 Trc 04542 EventLocationInfo sent to 29

Re: multi-timestamps/multi-line help

somesoni2 — Fri, 31 Jan 2014 22:50:12 GMT

Try this

[yoursourcetype]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%H:%M:%S.%3Q
TIME_PREFIX=[@]*

Re: multi-timestamps/multi-line help

a212830 — Thu, 06 Feb 2014 16:25:40 GMT

That didn't work.

Re: multi-timestamps/multi-line help

theouhuios — Thu, 06 Feb 2014 16:31:21 GMT

Are you trying to use the first time after @ as the timestamp?

Re: multi-timestamps/multi-line help

a212830 — Fri, 07 Feb 2014 02:09:37 GMT

I would need multiple timestamps: the ones that have the @ and the ones without are both valid.

Re: multi-timestamps/multi-line help

somesoni2 — Fri, 07 Feb 2014 05:33:40 GMT

try with TIME_PREFIX = (@)*

topic Re: multi-timestamps/multi-line help in Getting Data In

multi-timestamps/multi-line help

Re: multi-timestamps/multi-line help

Re: multi-timestamps/multi-line help

Re: multi-timestamps/multi-line help

Re: multi-timestamps/multi-line help

Re: multi-timestamps/multi-line help