https://community.splunk.com/t5/Getting-Data-In/Need-help-parsing-Venafi-logs/m-p/338170#M94895 <P>We are feeding Venafi logs into Splunk and have trouble with records breaking at the wrong places.</P> <P>This is the format of the input - all log records start with this:<BR /> 10.213.32.41,4/16/2018 11:06 AM,0001001D,...<BR /> IP date time 8 hex-character event ID</P> <P>and can have multiple lines per record.</P> <P>Can someone suggest sourcetype configuration to correctly parse our logs?</P> Mon, 16 Apr 2018 21:13:28 GMT miuwang 2018-04-16T21:13:28Z https://community.splunk.com/t5/Getting-Data-In/Need-help-parsing-Venafi-logs/m-p/338170#M94895 <P>We are feeding Venafi logs into Splunk and have trouble with records breaking at the wrong places.</P> <P>This is the format of the input - all log records start with this:<BR /> 10.213.32.41,4/16/2018 11:06 AM,0001001D,...<BR /> IP date time 8 hex-character event ID</P> <P>and can have multiple lines per record.</P> <P>Can someone suggest sourcetype configuration to correctly parse our logs?</P> Mon, 16 Apr 2018 21:13:28 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-parsing-Venafi-logs/m-p/338170#M94895 miuwang 2018-04-16T21:13:28Z https://community.splunk.com/t5/Getting-Data-In/Need-help-parsing-Venafi-logs/m-p/338171#M94896 <P>Try this (props.conf on your indexer/heavy forwarder)</P> <PRE><CODE>[Venafi_Logs] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=\d{1.3}\.\d{1.3}\.\d{1.3}\.\d{1.3},\d+\/\d+\/\d+\s\d+\:\d+) TIME_PREFIX = ^\d{1.3}\.\d{1.3}\.\d{1.3}\.\d{1.3}, TIME_FORMAT = %m/%d/%Y %H:%M %p MAX_TIMESTAMP_LOOKAHEAD = 19 </CODE></PRE> Mon, 16 Apr 2018 22:50:25 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-parsing-Venafi-logs/m-p/338171#M94896 somesoni2 2018-04-16T22:50:25Z