topic Single log is getting split into two events. in Getting Data In

Single log is getting split into two events.

vrathore2016 — Thu, 19 Jul 2018 19:11:32 GMT

I am not using props.conf. So I guess it is the default behavior.

Below is the single log:

2018-07-19 13:30:40.293 +0000  [http8080] INFO  RequestFilter- {
  "transaction_id" : "aaaaaaaaawwwwwwww",
  "http_method" : "POST",
  "date_time" : "2018-07-19 13:30:34.694 +0000",
  "requestId" : "20180719-dc7bc01d-b02c-43c8-932b-42af542ccefb"
}

But it is coming in 2 events

2018-07-19 13:30:40.293 +0000  [http8080] INFO  RequestFilter- {
      "transaction_id" : "aaaaaaaaawwwwwwww",
      "http_method" : "POST",

And

"date_time" : "2018-07-19 13:30:34.694 +0000",
  "requestId" : "20180719-dc7bc01d-b02c-43c8-932b-42af542ccefb"
}

It is always breaking from "date_time"

Any suggestions? how can i fix it?

Re: Single log is getting split into two events.

Shan — Fri, 20 Jul 2018 07:41:28 GMT

@ vrathore2016

As your data set have two time value. Splunk consider it as two events. Following are my suggestion .. Give a try.

1.While uploading data into splunk you will see a option called Timestamp below setting up source type. 
In that Timestamp you will have a option called Lookahead. Try to set the value over here like 30 or 40 based on your timestamp data volume..

2. set up the props.conf as mentioned below .. 
TIME_PREFIX= \d{4}-\d{2}-\d{2}  \d{2}:\d{2}:\d{2.\d{3}

Give a try ....

Re: Single log is getting split into two events.

thambisetty — Fri, 20 Jul 2018 09:51:02 GMT

Hi,

The best way to preview of data how its going be indexed in Splunk is to take an example log or logs and put it in notepad and try to upload using add data feature in Splunk. if you see your data is split or timestamp is not recognized , you can make changes there it self then you copy those config and apply in Heavy forwarder or Indexer.