topic Re: What will be LINE_BREAKER for these events? in Getting Data In

What will be LINE_BREAKER for these events?

muizash — Wed, 30 Sep 2020 03:08:29 GMT

2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic -
2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic -
2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic -
2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic -
2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic -

Please write the LINE_BREAKER for these events, i know splunk will automatically do it for these events but these are not the only events I have. I cannot share share those events here. However every time stamp starts like this. If there is additional info to be written in props.conf. Please write

Thanks

Re: What will be LINE_BREAKER for these events?

gcusello — Tue, 26 Nov 2019 11:50:31 GMT

HI @muizash,
did you already tried something like this in your props.conf?

[your_sourcetype]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

Ciao.
Giuseppe

Re: What will be LINE_BREAKER for these events?

wmyersas — Tue, 26 Nov 2019 15:02:12 GMT

Your linebreaker should look like this in your props.conf:

[your:sourcetype]
LINE_BREAKER = ([\r\n\f]+)
SHOULD_LINEMERGE = false 
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 30

It's always a best practice to formally set both the LINE_BREAKER and SHOULD_LINEMERGE (according to the props.conf spec, you must set SHOULD_LINEMERGE when you set LINE_BREAKER).

Re: What will be LINE_BREAKER for these events?

woodcock — Tue, 26 Nov 2019 23:55:56 GMT

Like this:

LINE_BREAKER = ([\r\n]+)\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2},\d{3}
SHOULD_LINEMERGE = false

Re: What will be LINE_BREAKER for these events?

arjunpkishore5 — Wed, 27 Nov 2019 01:27:35 GMT

You don't need line breaker if every line is starting with the timestamp. You just need to break the events before the timestamp.

[your stanza]
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
BREAK_ONLY_BEFORE_DATE = true
SHOULD_LINEMERGE = false

hope this helps.

Re: What will be LINE_BREAKER for these events?

muizash — Wed, 27 Nov 2019 03:53:24 GMT

yes, thanks

Re: What will be LINE_BREAKER for these events?

arjunpkishore5 — Wed, 27 Nov 2019 13:29:52 GMT

Hi @muizash

Did any of the suggested solutions work for you?