Date is creating separate event

piyali_sarkar — Wed, 30 Sep 2020 02:52:49 GMT

Hi All,

I am trying index .txt file via universal forwarder, below is sample data and props.conf file:

================================================

11/03/2019:00:02:34

Sample: Complete last indexed: 11/3/2019 12:02:21 AM number of objects: 0 start: 11/3/2019 12:02:21 AM duration: 1 seconds
Production: Complete last indexed: 11/2/2019 11:59:55 PM number of objects: 11 start: 11/3/2019 12:00:26 AM duration: 115 seconds
Administration: Complete last indexed: 11/3/2019 12:00:19 AM number of objects: 0 start: 11/3/2019 12:00:19 AM duration: 1 seconds
Archive: Complete last indexed: 11/3/2019 12:00:12 AM number of objects: 0 start: 11/3/2019 12:00:13 AM duration: 6 seconds

props.conf:

[index:test14]
TIME_PREFIX= ^
TIME_FORMAT = %m/%d/%Y:%H:%M:%S
SHOULD_LINEMERGE= true
TRUNCATE = 0
MAX_EVENTS = 10000
BREAK_ONLY_BEFORE_DATE = True

after indexing "11/03/2019:00:02:34" is creating a separate event and rest another event.
How to get both in a single event?

Thanks in advance

Re: Date is creating separate event

gcusello — Wed, 30 Sep 2020 02:52:55 GMT

Hi piyali_sarkar,
I don't understand: do you want only one event or one event for each row?
if only one event, you have to use a different TIME_PREFIX

TIME_PREFIX=^\=*

If instead you want one event for each row, you have to use as TIME_PREFIX

TIME_PREFIX= Complete last indexed:\s+

Ciao.
Giuseppe

topic Re: Date is creating separate event in Getting Data In

Date is creating separate event

11/03/2019:00:02:34

Re: Date is creating separate event