topic Re: Source Type, Web Application and BREAK_ONLY_BEFORE in Getting Data In

Source Type, Web Application and BREAK_ONLY_BEFORE

jsgossett — Fri, 13 Nov 2020 15:54:11 GMT

I discovered our logs were split between events. I notice that Splunk split the event ANY date and time it found in our logs. See below.

<ResponseEndTimestamp>11/05/2020 09:53:33</ResponseEndTimestamp> </RCExtResponse> 2020-11-05 08:53:36,916 [http-nio-8080-exec-4] [198.153.9.206||1573FF21ECE6B4E4DA213F08E73230B3|] INFO c.v.c.d.DrFirstGatewayService - Retrived patient object(Patient:...) ....

2020-11-05 08:53:37,110 [http-nio-8080-exec-4] should have started a new event.

To fix, I wanted to defined a BREAK_ONLY_BEFORE in the Source Type. Unfortunately, the Web UI keeps changing values when I save. See before and after.

Before

Before

After

After

Has anyone encountered this? Any help would be greatly appreciated.

Josh

Re: Source Type, Web Application and BREAK_ONLY_BEFORE

richgalloway — Tue, 10 Nov 2020 18:05:13 GMT

It's more efficient to use LINE_BREAKER. Try these props.conf settings.

[STM] SHOULD_LINEMERGE = false LINE_BREAKER = \<\/RCExtResponse\>() TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD = 23

Re: Source Type, Web Application and BREAK_ONLY_BEFORE

jsgossett — Tue, 10 Nov 2020 20:31:47 GMT

Rich,

Thank you so much. You were helpful.

In the end, I used the following configuration.

TIME_PREFIX	^
TIME_FORMAT	%Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD	23

I excluded the LINE_BREAKER and SHOULD_LINEMERGE settings since we still want to use default value (e.g. (\n\r)+). Also, our events expand multiple lines