https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527598#M88970 <P>Certain events in these logs have dates in certain tags below such as &lt;BeginDateTime&gt; and &lt;EndDateTime&gt; . They are creating additional events when they should only be one. Same thing on JMS Timestamp on event 2 pictured below. What would the correct regex be to only make events when the timestamp is first like in 1, 5-9. Thank you.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bnichols024_0-1604350604708.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11615i97465EACDF769218/image-size/medium?v=v2&amp;px=400" role="button" title="bnichols024_0-1604350604708.png" alt="bnichols024_0-1604350604708.png" /></span></P><P>&nbsp;</P> Mon, 02 Nov 2020 21:01:53 GMT bnichols024 2020-11-02T21:01:53Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527598#M88970 <P>Certain events in these logs have dates in certain tags below such as &lt;BeginDateTime&gt; and &lt;EndDateTime&gt; . They are creating additional events when they should only be one. Same thing on JMS Timestamp on event 2 pictured below. What would the correct regex be to only make events when the timestamp is first like in 1, 5-9. Thank you.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bnichols024_0-1604350604708.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11615i97465EACDF769218/image-size/medium?v=v2&amp;px=400" role="button" title="bnichols024_0-1604350604708.png" alt="bnichols024_0-1604350604708.png" /></span></P><P>&nbsp;</P> Mon, 02 Nov 2020 21:01:53 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527598#M88970 bnichols024 2020-11-02T21:01:53Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527726#M88994 <P>The props.conf settings are not correct for that sourcetype.&nbsp; Please share the current settings and also specify where events should begin and end.</P> Tue, 03 Nov 2020 13:59:04 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527726#M88994 richgalloway 2020-11-03T13:59:04Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527736#M88996 <P>I don't have a props.conf file currently configured. That's what I'm asking for help with. I want events to break like they normally would before timestamps, but to not include the time stamps you see in events 2, 3, and 4 in the image. Only timestamps that start a line.</P> Tue, 03 Nov 2020 14:19:11 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-timestamps-creating-extra-events/m-p/527736#M88996 bnichols024 2020-11-03T14:19:11Z