topic Re: If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two? in Getting Data In

If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

sfilipov — Fri, 05 Oct 2018 08:40:48 GMT

We have divider of logs as DateTime value. If Splunk forwarder sees DateTime value in the string, it forms other log-records in the server. Look at the screenshot: we can see 2 parts of one log, but we need whole 1 log

Thanx 🙂

Re: If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

harsmarvania57 — Fri, 05 Oct 2018 09:34:57 GMT

Hi @sfilipov,

You can set below configuration on Indexer or Heavy Forwarder which ever comes first from Universal Forwarder to parse timestamp correctly and break line properly and then restart splunk on Indexer or Heavy Forwarder.

props.conf

[yoursourcetype]
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%:z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=29

Re: If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

493669 — Fri, 05 Oct 2018 09:36:41 GMT

Add below stanza in props.conf

[<yoursourcetypeName>]
MAX_TIMESTAMP_LOOKAHEAD = 20
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = ^

Re: If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

493669 — Fri, 05 Oct 2018 09:42:01 GMT

connverted to comment as @harsmarvania57 answer is more correct

Re: If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

sfilipov — Tue, 09 Oct 2018 13:21:41 GMT

not working for me 😞 maybe because sourcetype contains '-' symb?

    [evenue-raw]
    TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%:z
    TIME_PREFIX=^
    MAX_TIMESTAMP_LOOKAHEAD=29

Re: If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

harsmarvania57 — Tue, 09 Oct 2018 15:33:22 GMT

No, I don't think so - in sourcetype will create problem. How Universal Forwarder is sending data to Indexers (Directly to Indexer OR via Heavy Forwarder)? On which server you implemented above config and have you restarted splunk after changes (Data which is already indexed in splunk will not change, only new data will parse and index properly)?