props.conf time_format for source

rlaan — Wed, 31 Mar 2021 22:01:02 GMT

Goal is to parse new events based on this source value into multiline events split each time a new date is encountered.

Currently the events are not splitting correctly based on the date, as well as the AM/PM not being discovered causing all of the morning and afternoon data to overlap in the first 12 hours of the _time field.

Time stamp from log
<31-Mar-2021 3:18:04 o'clock AM MDT> <Error> <Default>

[source::/fmw/product/.../servers/logs/domain-1.out]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = <\d+-\w+
TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 40

[source::/fmw/product/.../servers/logs/domain-2.out]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = <\d+-\w+
TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 40

Re: props.conf time_format for source

richgalloway — Thu, 01 Apr 2021 00:10:41 GMT

Try these settings. Perhaps most important is escaping the < in a regex.

SHOULD_LINEMERGE = false TIME_PREFIX = \< TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z MAX_TIMESTAMP_LOOKAHEAD = 40 LINE_BREAKER = ([\r\n]+)\<\d+-

topic Re: props.conf time_format for source in Splunk Search

props.conf time_format for source

Re: props.conf time_format for source