https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342345#M101416 <P>try this...</P> <PRE><CODE>BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{6}[\s:] </CODE></PRE> Tue, 19 Sep 2017 13:56:16 GMT DalJeanis 2017-09-19T13:56:16Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342344#M101415 <P>Hi All,</P> <P>I have created an index and sourcetype for two logs files.<BR /> I have set up my props.conf to extract the date/time and separate onto one line, however one of my logs has a colon after the time and it is not separating out correctly.</P> <P>see below.</P> <PRE><CODE>19/09/2017 13:34:51.438 2017-09-19 13:34:51.438683 [ptp1:pps--phc1(ens1f0/ens1f1)], last: 0, mean: 0, min: 2147483647, max: -2147483647, bad-period: 0, overflows: 0 19/09/2017 13:34:51.437 2017-09-19 13:34:51.437853: warning: ptp ptp1: failed to receive Announce within 12.000 seconds 2017-09-19 13:34:51.437898: debug: ptp ptp1: state PTP_LISTENING 2017-09-19 13:34:51.437911: debug: netRefreshIGMP 19/09/2017 13:34:50.823 2017-09-19 13:34:50.823439 [phc0(ens1f0/ens1f1)-&gt;system], offset: -8.875, freq-adj: -42949.984, in-sync: 1 </CODE></PRE> <P>my props.conf file<BR /> [ptp_log]<BR /> SHOULD_LINEMERGE = true<BR /> BREAK_ONLY_BEFORE_DATE = false<BR /> BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{6}\s<BR /> MAX_TIMESTAMP_LOOKAHEAD = 26<BR /> TIME_PREFIX = ^</P> <P>If I put a colon into regex it will miss the other log file.<BR /> Is the only way to do this two sourcetypes?</P> <P>Thanks,</P> Tue, 29 Sep 2020 15:48:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342344#M101415 ssaenger 2020-09-29T15:48:59Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342345#M101416 <P>try this...</P> <PRE><CODE>BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{6}[\s:] </CODE></PRE> Tue, 19 Sep 2017 13:56:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342345#M101416 DalJeanis 2017-09-19T13:56:16Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342346#M101417 <P>worked a treat thanks.</P> Tue, 19 Sep 2017 15:15:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-props-conf-to-cope-with-two-different-time-values-in/m-p/342346#M101417 ssaenger 2017-09-19T15:15:07Z