topic Re: Line breaker to break the events in Getting Data In

Line breaker to break the events

raju_dara — Mon, 28 Sep 2020 12:47:16 GMT

Below is the app log content and the configuration parameters in props.conf. Not sure what is going wrong.. Output is all messed up and I dont see the events getting generated seperatly.. Any help??

11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

TRUNCATE=240000
TIME_PREFIX = ^Timestamp:\s
TIME_FORMAT= %m/%d/%Y %H:%M:%S
LINE_BREAKER = ([\r\n]+)(?=Timestamp:\s)
SHOULD_LINEMERGE=false

This is what I am expecting on SPLUNK
Event One
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

Event two

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

Event three..

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

Re: Line breaker to break the events

lguinn2 — Mon, 28 Sep 2020 12:47:21 GMT

You do not need a time prefix or a line breaker. Try

TRUNCATE=240000 
TIME_FORMAT= %m/%d/%Y %H:%M:%S 
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE_DATE = true

You don't actually need the last 2 lines either, as these are the defaults. And MAX_TIMESTAMP_LOOKAHEAD is just for efficiency.

Re: Line breaker to break the events

raju_dara — Tue, 13 Nov 2012 03:48:53 GMT

Thank you but no luck.. :(.. Any more suggestions??

Re: Line breaker to break the events

raju_dara — Tue, 13 Nov 2012 05:42:05 GMT

Below is the output.. Last 3 lines should be part of Event2..

Event 1
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event 2
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
Event 3
;ZZZZ
Event 4
;ZZZY

Re: Line breaker to break the events

martin_mueller — Tue, 13 Nov 2012 08:15:22 GMT

You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.

Re: Line breaker to break the events

raju_dara — Tue, 13 Nov 2012 17:46:04 GMT

That did the knack.. Thank you soo much..