topic Splunk line breaking issue in Getting Data In

Splunk line breaking issue

knalla — Fri, 07 May 2021 04:46:02 GMT

Hi, I'm trying to line break events and extract time stamp, but it has no date any ideas how to get this?

[04:05:16.255][t] setting data time stamp

[04:05:14.255][t] setting data time stampwewe22

[04:05:12.255][t] setting data time etc

<PSET>CDPTLSGSG <cc>

Splunk line breaking issue

The_Simko — Fri, 07 May 2021 17:12:10 GMT

Good day Knalla,

If the logs are from the current day, then you are in luck:
in props:
TIME_FORMAT=\d{2}:\d{2}:\d{2}\.\d{3}
TIME_PREFIX=^\[
MAX_TIMESTAMP_LOOKAHEAD=25

Now, if the logs aren't from the given day you'll have to do something like store the logs in a directory with the date. then use the above props and you can bring in data

Good luck!