topic Re: multiline events in Dashboards & Visualizations

multiline events

isha_ish — Wed, 14 Oct 2020 18:52:47 GMT

Am getting multiline events. below events should be shown separately for each time. how to fix this . on my props.conf i have the below config. but it isn't working

BREAK_ONLY_BEFORE_DATE=true
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 24

14/10/2020
19:46:58.035

2020-10-14T19:46:58.035+01:00 INFO [r] (default task-11) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx]

2020-10-14T19:46:58.035+01:00 INFO [] (default task-82) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx]

2020-10-14T19:46:58.035+01:00 INFO [] (default task-11) User token loaded. [windowsId=null,internal=false,externalOrigin=false,status=TOKEN_IS_NULL_OR_EMPTY] 2020-10-14T19:46:58.035+01:00 INFO [sso.AuthFilter

Re: multiline events

to4kawa — Wed, 14 Oct 2020 19:45:47 GMT

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

I think it's OK.

Re: multiline events

richgalloway — Wed, 14 Oct 2020 20:12:10 GMT

The events aren't matching the TIME_FORMAT setting. Try these settings

TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z MAX_TIMESTAMP_LOOKAHEAD = 30 LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false

Re: multi-line events

isha_ish — Thu, 15 Oct 2020 05:18:11 GMT

Multiline events are solved now. but the line which should be on multiline like the postman commands and the result are also coming in separate line. any way to fix it ?

	15/10/2020 06:06:16.069	1875094 < Transfer-Encoding: chunked host = lonrsxxx index = agile-xxx source = /exxx sourcetype = amservices-log splunk_server = lonrsxxx
	15/10/2020 06:06:16.069	1875094 < Server: Apache-Coyote/1.1 host = lonrsxxx index = agile-xxxx source = /exxx sourcetype = amservices-log splunk_server = lonrxxxx
	15/10/2020 06:06:16.069	1875094 < Date: Thu, 15 Oct 2020 05:06:15 GMT host = lonrs1xxx index = agile-main source = /exxxx sourcetype = amsexxx splunk_server = lonrsxxxx
	15/10/2020 06:06:16.069	1875094 < Content-Type: application/json;charset=UTF-8