topic help with props.conf in Getting Data In

help with props.conf

vrmandadi — Fri, 27 Mar 2020 17:52:58 GMT

I have the following raw data and I am trying to break the individual events starting with timestamp and before another timestamp starts .

2020-03-27 00:00:00.003 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): Starting model computation2020-03-27 00:00:00.033 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): # data set ids: 9 / # events: 02020-03-27 00:00:00.050 [quartzJobExecutor-1] INFO c.c.d.c.s.StatisticSchedulerJob - StatisticScheduler saving <21> statistics for statistic 2020-03-27 00:00:00.050 [pool-9-thread-1] INFO c.c.d.core.statistic.StatisticBuffer - Persisting <21> statistics

Thanks in Advance

Re: help with props.conf

richgalloway — Fri, 27 Mar 2020 19:11:38 GMT

Try these settings for starters:

[mysourcetype]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]]+)
TRUNCATE = 10000

Re: help with props.conf

vrmandadi — Fri, 27 Mar 2020 19:29:54 GMT

Hello @richgalloway I tried this but it did not work . I am looking to break the events like below from the sample event

2020-03-27 00:00:00.003 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): Starting model computation

2020-03-27 00:00:00.033 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): # data set ids: 9 / # events: 0

2020-03-27 00:00:00.050 [quartzJobExecutor-1] INFO c.c.d.c.s.StatisticSchedulerJob - StatisticScheduler saving statistics for statistic

2020-03-27 00:00:00.050 [pool-9-thread-1] INFO c.c.d.core.statistic.StatisticBuffer - Persisting statistics

Re: help with props.conf

richgalloway — Fri, 27 Mar 2020 19:52:55 GMT

What part is not working? What are you getting?
Did you restart Splunk after changing props.conf?
Did you put the props.conf file in the right place (indexer or HF)?

Re: help with props.conf

vrmandadi — Wed, 30 Sep 2020 05:03:45 GMT

Yes I checked everthing .

This worked for me.

[sourcetype]
SHOULD_LINEMERGE= false
LINE_BREAKER= ()(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})
NO_BINARY_CHECK= true
MAX_DAYS_AGO= 2

Re: help with props.conf

richgalloway — Fri, 27 Mar 2020 21:08:34 GMT

Glad you have it working. Do use TIME_FORMAT, however.