topic Timestamp containing newline in Getting Data In

Timestamp containing newline

las — Mon, 21 Sep 2020 07:40:26 GMT

Hi.

I have just been presented with a very curious timestamp format.

18-08-2020 15:41:00,07 No running service instances found 0 service instances are online, which is different from the expected count of 1. 18-08-2020 15:46:00,13 No running service instances found 0 service instances are online, which is different from the expected count of 1.

My first instinct is to create a timeformat = %d-%m%Y\n%H:%M:%S,%2N, but is it at all possible to mix regex with strptime() formats?

Has anybody encountered something like it, and what solution did you come up with.

Re: Timestamp containing newline

thambisetty — Mon, 21 Sep 2020 07:46:34 GMT

is that single event?

what is your SHOULD_LINEMERGE for this sourcetype?

Re: Timestamp containing newline

las — Mon, 21 Sep 2020 07:53:50 GMT

Sorry, that is two events. Splunk by the timestamp containing the newline.

SHOULD_LINEMERGE = true

Just after I posted this I got thinking, and startet playing with LINE_BREAKER=([\r\n]+)\d{2}-\d{2}, that seems to be able to do the trick