topic Re: How to wok with event Linebreaking in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-wok-with-event-Linebreaking/m-p/47941#M9067 <P>Specifying \)"\s+ as timestamp prefix appears to pick out the 05:30:00.444 together with the second 2013-01-23 later in the line.</P> <P>Edit: The closing parenthesis appears to be part of the referer, hence bad to use - (\S+\s+){15} with appropriate values for the max lookahead should do the same.</P> Fri, 01 Mar 2013 09:06:26 GMT martin_mueller 2013-03-01T09:06:26Z How to wok with event Linebreaking https://community.splunk.com/t5/Getting-Data-In/How-to-wok-with-event-Linebreaking/m-p/47940#M9066 <P>Hello Everyone,</P> <P>I have one IIS Log files </P> <P>example :<BR /> <STRONG>2013-01-23</STRONG> 00:00:00.444 "AEPLWEB2" "66.249.74.162" /research/userreviews/reviewdetails.aspx rid=114 "E:\sites\carwale\research\userreviews\reviewdetails.aspx" 200 - 0 15036 306 - - "Mozilla/5.0 (compatible; Googlebot/2.1; +<A href="http://www.google.com/bot.html)">http://www.google.com/bot.html)</A>" <STRONG>05:30:00.444</STRONG> 436 0 "WWW.CARWALE.COM" 192.168.1.15 80 3.944 - "HTTP/1.1" "http" GET "<A href="http://www.carwale.com">www.carwale.com</A>" 2013-01-23 00:00:00.444 2013-01-23 11.37 - 2013-01-23 00:00:00.008</P> <P>When i input this file the by default time stamp taken was <STRONG>2013-01-23 00:00:00.444</STRONG> But According to IST i want make time stamp as <STRONG>2013-01-23 05:30:00.444</STRONG> as made bold in line also.</P> <P>How can i do this. How can i create Timestamp.?</P> <P>Thanks a regrads,<BR /> Gajanan Hiroji</P> Fri, 01 Mar 2013 06:31:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-wok-with-event-Linebreaking/m-p/47940#M9066 gajananh999 2013-03-01T06:31:56Z Re: How to wok with event Linebreaking https://community.splunk.com/t5/Getting-Data-In/How-to-wok-with-event-Linebreaking/m-p/47941#M9067 <P>Specifying \)"\s+ as timestamp prefix appears to pick out the 05:30:00.444 together with the second 2013-01-23 later in the line.</P> <P>Edit: The closing parenthesis appears to be part of the referer, hence bad to use - (\S+\s+){15} with appropriate values for the max lookahead should do the same.</P> Fri, 01 Mar 2013 09:06:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-wok-with-event-Linebreaking/m-p/47941#M9067 martin_mueller 2013-03-01T09:06:26Z