https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343028#M63153 <P>works like a charm! Thank you!!!</P> Thu, 19 Apr 2018 22:57:41 GMT dperry 2018-04-19T22:57:41Z https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343026#M63151 <P>04/19/18 12:32:17.398524 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos<BR /> tLoanExists).DATETIME(4/19/2018 12:32:17 PM)~A0~BLMS~DCARD~F??????????????~HL<BR /> OAN~JID=ALL</P> <P>04/19/18 12:32:17.398907 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H<BR /> ostLoanExists).DATETIME(4/19/2018 12:32:17 PM)~K1:SymConnect is off host</P> <P>04/19/18 12:33:26.915422 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Ho<BR /> stLoanExists).DATETIME(4/19/2018 12:33:26 PM)~A0~BLMS~DCARD~F??????????????~H<BR /> LOAN~JID=ALL</P> <P>04/19/18 12:33:26.930871 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(<BR /> HostLoanExists).DATETIME(4/19/2018 12:33:26 PM)~K0~JID=01~JID=02~JID=03~JID=0<BR /> 4~JID=05~JID=06~JID=07~JID=08~JID=09~JID=10~JID=80~JID=81~JID=82</P> <P>04/19/18 12:33:39.309465 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos<BR /> tLoanExists).DATETIME(4/19/2018 12:33:39 PM)~A0~BLMS~DCARD~F??????????????~HL<BR /> OAN~JID=ALL</P> <P>04/19/18 12:33:39.310146 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H<BR /> ostLoanExists).DATETIME(4/19/2018 12:33:39 PM)~K0~JID=01~JID=02~JID=80~JID=81</P> <P>04/19/18 12:34:05.371520 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos<BR /> tLoanExists).DATETIME(4/19/2018 12:34:05 PM)~A0~BLMS~DCARD~F??????????????~HL<BR /> OAN~JID=ALL</P> <P>04/19/18 12:34:05.372184 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H<BR /> ostLoanExists).DATETIME(4/19/2018 12:34:05 PM)~K0~JID=80</P> <P>04/19/18 12:34:57.811784 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Host<BR /> LoanExists).DATETIME(4/19/2018 12:34:57 PM)~A0~BLMS~DCARD~F??????????????~HLO<BR /> AN~JID=ALL</P> <P>A new entry always begin with 00/00/00</P> <P>What would the line_break be for my props?</P> Thu, 19 Apr 2018 21:00:04 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343026#M63151 dperry 2018-04-19T21:00:04Z https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343027#M63152 <P>Try this (props.conf on your indexer/heavy forwarder)</P> <PRE><CODE>[yoursourcetype] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=\d+\/\d+\/\d+\s\d+\:) TIME_PREFIX = ^ TIME_FORMAT = %m/%d/%y %H:%M:%S.%6N MAX_TIMESTAMP_LOOKAHEAD = 26 </CODE></PRE> Thu, 19 Apr 2018 21:39:20 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343027#M63152 somesoni2 2018-04-19T21:39:20Z https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343028#M63153 <P>works like a charm! Thank you!!!</P> Thu, 19 Apr 2018 22:57:41 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-Line-Break-for-log/m-p/343028#M63153 dperry 2018-04-19T22:57:41Z