multiline event not working

mfscully — Mon, 28 Sep 2020 16:38:08 GMT

I am trying to split the following log into two events based on the line feed in between the events:

15-May-2014 11:49:12.563  (2ba825c174c0) LV3         THandlerUtil::transactionHandlerDispatch: Handle Message Start ==> 

15-May-2014 11:49:12.564  (2ba825c174c0) LV3         THandlerUtil::transactionHandlerDispatch: Call Sequence:[Scheduled

* 0x683a2e0514bc426aa3d85a3a4c27b76a->TCAutoStageEquipment[05/15/14 11:49:09:EquipId: [W29M6P5400] Workstation:[630PRB_NAND

15-May-2014 11:49:12.565  (2ba825c174c0) LV4             TCAutoStageEquipment::LotList:  Entering...

15-May-2014 11:49:12.566  (2ba825c174c0) LV3            Timer::Cancel: Canceled Timer Request for TIMER_malamhstes

15-May-2014 11:49:12.570  (2ba825c174c0) LV3           TCAutoStageEquipment::LotList: W29M6P5400: No lots to stage

15-May-2014 11:49:12.571  (2ba825c174c0) LV3            TCMIPCHandler::LogBusinessEvent: BECode:[ASAE21], BEShortDesc:[NothingToStage], BEText:[W29M6P5400: Nothing to stage - 0 lot lists in dispatch list]

15-May-2014 11:49:12.576  (2ba825c174c0) LV4             TCAutoStageEquipment::LotList:  Exiting...

0x019ffbf889e849a0b87f7dc25d396464->TCAutoStageEquipment[05/15/14 11:49:09:EquipId: [RMAC6M3700] Workstation:[630RDA_MACRO] ScheduleMethod:[RTD] StageToTheMax:[-empty-] FailedLots:[{}] StagedLots:[{}] BadRecipes:[{}] ClaimResource:[-empty-] State:[Running] ExpectedMessages:[{LotList,LotListTimeout}]]

15-May-2014 11:49:12.588 (2ba825c174c0) LV3 THandlerUtil::transactionHandlerDispatch: Handle Message Start ==>
15-May-2014 11:49:12.589 (2ba825c174c0) LV3 THandlerUtil::transactionHandlerDispatch: Call Sequence:[ScheduledEvent

I tried the following in my props.conf and it does not work:

[source::.../trace/AMHSAutoStageSrv/.../AutoStageSrv-TransactionTrace*.trc]

sourcetype = autostagesrv_transactiontrace

TRUNCATE = 0

SHOULD_LINEMERGE = True

BREAK_ONLY_BEFORE_DATE = False
LINE_BREAKER = ^\n

BREAK_ONLY_BEFORE = Handle\sMessage\sStart

MAX_EVENTS = 500

Any ideas?

Re: multiline event not working

somesoni2 — Thu, 15 May 2014 21:34:57 GMT

Can you give this a shot?

In your props.conf

BREAK_ONLY_BEFORE=Handle\sMessage\sStart
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

Re: multiline event not working

mfscully — Thu, 15 May 2014 22:08:20 GMT

using those settings it parses the message as such:



* 0x261fce339fb44db2be02f10f4228ab29->TCQualStartRun[05/15/14 17:32:36:State:[Running] ExpectedMessages:[{QualStartRun}]]

15-May-2014 17:32:36.431  (2ab9fefe44c0) LV4             TCQualStartRun::QualStartRun:  Entering...

15-May-2014 17:32:36.441  (2ab9fefe44c0) LV4             TCQualStartRun::QualStartRun:  Exiting...

Are the asterisks in the log message causing issues with splunk?

topic multiline event not working in Getting Data In

multiline event not working

SHOULD_LINEMERGE = True

BREAK_ONLY_BEFORE = Handle\sMessage\sStart

Re: multiline event not working

Re: multiline event not working