topic Re: How to write regex to create new events before a certain time format? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195398#M38866 <P>Yes. I did</P> Tue, 26 Aug 2014 15:04:34 GMT rameshlpatel 2014-08-26T15:04:34Z How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195391#M38859 <P>Hi,</P> <P>Please some help me to create new event if i find HH:MM:SS time format in logs for sourcetype perfLog.</P> <P>I have used below configuration in props.conf file inside Indexer /opt/splunk/etc/system/local dir.</P> <PRE><CODE>[sourcetype::perfLog] SHOULD_LINEMERGE=false BREAK_ONLY_BEFORE=^(?:\d|[01]\d|2[0-3]):[0-5]\d$ </CODE></PRE> <P>But still it did not work. Below are the example of logs.</P> <P><STRONG>08:11:13</STRONG> |INFO | | LoggingHandler | ausu512a.wm.com|{<A href="http://esb.wm.com/service/getCustAccountInfo%7DgetCustAccountInfo%7CgetCustAccountInfo%7C329179%7CSTART">http://esb.wm.com/service/getCustAccountInfo}getCustAccountInfo|getCustAccountInfo|329179|START</A> TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|244| MS |ESB CALL|TRANSACTION ID|2934447739687911190|<BR /> 08:11:13 |DEBUG | | Profiler | ausu512a.wm.com|class com.wm.css.payment.dao.impl.PayTransactionDaoImpl|List com.wm.css.payment.dao.PayTransactionDao.getPaymentDetailsForAccount(String)|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|26| MS |<BR /> 08:11:13 |DEBUG | | Profiler | ausu512a.wm.com|class com.wm.css.payment.service.impl.PaymentServiceImpl|List com.wm.css.payment.service.PaymentService.getPaymentDetailsForAccount(String)|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|26| MS |</P> Tue, 26 Aug 2014 13:16:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195391#M38859 rameshlpatel 2014-08-26T13:16:10Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195392#M38860 <P>Your regex isn't matching, so...</P> <P>You're looking for <CODE>^(?:\d|[01]\d|2[0-3]):[0-5]\d$</CODE> and I don't see that matching anything in your sample events. </P> Tue, 26 Aug 2014 13:26:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195392#M38860 Ayn 2014-08-26T13:26:52Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195393#M38861 <P>Help to create regex for same please ?</P> Tue, 26 Aug 2014 13:30:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195393#M38861 rameshlpatel 2014-08-26T13:30:53Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195394#M38862 <P>Try changing the <CODE>BREAK_ONLY_BEFORE</CODE> statement to '<CODE>LINE_BREAKER=([\r\n]+)(\d\d:\d\d:\d\d)</CODE>'.</P> Tue, 26 Aug 2014 13:33:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195394#M38862 richgalloway 2014-08-26T13:33:24Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195395#M38863 <P>My advice would be to use <A href="http://www.regexr.com">www.regexr.com</A> or similar to find a correct one <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Otherwise I'd just help you this once and you wouldn't learn anything.</P> Tue, 26 Aug 2014 13:36:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195395#M38863 Ayn 2014-08-26T13:36:59Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195396#M38864 <P>Thanks but its not working.</P> Tue, 26 Aug 2014 13:47:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195396#M38864 rameshlpatel 2014-08-26T13:47:08Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195397#M38865 <P>Did you restart Splunk?</P> Tue, 26 Aug 2014 13:50:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195397#M38865 richgalloway 2014-08-26T13:50:04Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195398#M38866 <P>Yes. I did</P> Tue, 26 Aug 2014 15:04:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195398#M38866 rameshlpatel 2014-08-26T15:04:34Z Re: How to write regex to create new events before a certain time format? https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195399#M38867 <P>Try this</P> <P>BREAK_ONLY_BEFORE=^\d{2}:\d{2}:\d{2}\s\|</P> Mon, 28 Sep 2020 17:24:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-create-new-events-before-a-certain-time/m-p/195399#M38867 somesoni2 2020-09-28T17:24:32Z