https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269778#M51791 <P>Tweak: <CODE>LINE_BREAKER=([\r\n]+)\[(ERROR|INFO|DEBUG)\]\s+</CODE><BR /> I think that does the same but might be easier to read.</P> Thu, 31 Mar 2016 19:14:11 GMT sloshburch 2016-03-31T19:14:11Z https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269774#M51787 <P>hI,</P> <P>I have a file that appears to break correctly in the data preview, but after I index it, it's not appearing correctly. (All on a stand-alone server).</P> <P>The file is this:</P> <P>[INFO] Root WebApplicationContext: initialization started<BR /> [INFO] Refreshing Root WebApplicationContext: startup date [Fri Oct 16 10:49:27 EDT 2015]; root of context hierarchy<BR /> [INFO] Loading XML bean definitions from ServletContext resource [/WEB-INF/frf-modeler-servlet.xml]<BR /> [INFO] Loading XML bean definitions from class path resource [application-context.xml]<BR /> [INFO] Pre-instantiating singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@6d50ff26: defining beans [modelerEngineController,org.springframework.context.annotation.internalConfigurationAnnotationProcessor,org.springframework.context.annotation.internalAutowiredAnnotationProcessor,org.springframework.context.annotation.internalRequiredAnnotationProcessor,org.springframework.context.annotation.internalCommonAnnotationProcessor,exportController,layoutServiceController,viewNameTranslator,org.springframework.web.servlet.view.BeanNameViewResolver#0,stringHttpMessageConverter,formHttpMessageConverter,jsonMessageConverter,byteArrayMessageConverter,jsonpHttpMessageConverter,multipartResolver,exceptionResolver,jsonView,com.fmrco.asts.frf.rest.spring.FRFAnnotationMethodHandlerAdapter#0,filterService,documentFormatter,configFilter,propertyConfigurer,gridExportUtil,mvcContentNegotiationManager,org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping#0,org.springframework.format.support.FormattingConversionServiceFactoryBean#0,org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter#0,org.springframework.web.servlet.handler.MappedInterceptor#0,org.springframework.web.servlet.mvc.method.annotation.ExceptionHandlerExceptionResolver#0,org.springframework.web.servlet.mvc.annotation.ResponseStatusExceptionResolver#0,org.springframework.web.servlet.mvc.support.DefaultHandlerExceptionResolver#0,org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping,org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter,org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter,jsonProcessService,treeCreationService,zipService,pomHandlerService,webXmlHandlerService,archiveTreeService,generalIOStreamProcessor,componentWithMetaDataBuilder,pomHandlerServiceImplHelper,org.springframework.context.annotation.ConfigurationClassPostProcessor.importAwareProcessor]; root of factory hierarchy<BR /> [splunk@vc2cmmka023053n fpcms]$ head -10 catalina.out <BR /> [INFO] Root WebApplicationContext: initialization started<BR /> [INFO] Refreshing Root WebApplicationContext: startup date [Fri Oct 16 10:49:27 EDT 2015]; root of context hierarchy<BR /> [INFO] Loading XML bean definitions from ServletContext resource [/WEB-INF/frf-modeler-servlet.xml]</P> <P>My props is:</P> <H1>set by detected source type</H1> <P>ANNOTATE_PUNCT=false<BR /> DATETIME_CONFIG = CURRENT<BR /> KV_MODE = auto<BR /> LINE_BREAKER = ([\r\n]+)([ERROR]|[INFO]|[DEBUG])<BR /> MAX_TIMESTAMP_LOOKAHEAD=150<BR /> SHOULD_LINEMERGE=false<BR /> pulldown_type=1</P> <P>When I preview it, it looks fine, but once I index it, it breaks very strangely. Any suggestions?</P> Tue, 29 Sep 2020 09:16:12 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269774#M51787 a212830 2020-09-29T09:16:12Z https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269775#M51788 <P>Hi,</P> <P>The events in the example are correct? I see that not all of them have time stamp.</P> <P>You sould identifie when start and ends a event and what timestamp do you want to setup.</P> <P>Regards,</P> Wed, 30 Mar 2016 09:41:13 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269775#M51788 jmallorquin 2016-03-30T09:41:13Z https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269776#M51789 <P>They don't have a timestamp, so I'm using the DATETIME_CONFIG statement and I want it to break on [INFO], [ERROR], [DEBUG] at the beginning of any line.</P> Wed, 30 Mar 2016 13:31:49 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269776#M51789 a212830 2016-03-30T13:31:49Z https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269777#M51790 <P>Use this props.conf configuration</P> <PRE><CODE>DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false NO_BINARY_CHECK=true LINE_BREAKER=([\r\n]+)(\[ERROR\]|\[INFO\]|\[DEBUG\])\s+ </CODE></PRE> Wed, 30 Mar 2016 13:38:24 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269777#M51790 jmallorquin 2016-03-30T13:38:24Z https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269778#M51791 <P>Tweak: <CODE>LINE_BREAKER=([\r\n]+)\[(ERROR|INFO|DEBUG)\]\s+</CODE><BR /> I think that does the same but might be easier to read.</P> Thu, 31 Mar 2016 19:14:11 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-LINE-BREAKING/m-p/269778#M51791 sloshburch 2016-03-31T19:14:11Z