topic How to setup linebreak and parse SUN IDM Server.log? in Getting Data In

How to setup linebreak and parse SUN IDM Server.log?

csunllopez — Mon, 28 Sep 2020 17:10:57 GMT

I am trying to setup a new linebreak for SUN IDM Server.log and the log outputs the following:

I am new to Splunk and still learning. Any help would be greatly appreciated.

Re: How to setup linebreak and parse SUN IDM Server.log?

somesoni2 — Fri, 25 Jul 2014 20:17:25 GMT

Try this in props.conf for your sourcetype on indexer/heavyforwarder.

[YourSourceType]
BREAK_ONLY_BEFORE=^\[#
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d%%H:%M:%S.%3Q%z
TIME_PREFIX=\[#\|

Re: How to setup linebreak and parse SUN IDM Server.log?

csunllopez — Fri, 25 Jul 2014 22:50:03 GMT

Thank you!