topic Re: Index Event Properly in Splunk Search

Index Event Properly

shangshin — Tue, 30 Jul 2013 16:25:43 GMT

Hi,
The event in my Log always has a prefix yyyy-MM-dd hh:mm:ss,SSS e.g. 2013-07-30 07:12:11,649
To have the event indexed properly, can I use the line below in props.conf

   BREAK_ONLY_BEFORE=yyyy-MM-dd hh:mm:ss,SSS

Thanks for the advice!

Re: Index Event Properly

shangshin — Mon, 28 Sep 2020 14:27:56 GMT

or
BREAK_ONLY_BEFORE=/d/d/d/d-/d/d-/d/d/ /d/d:/d/d:/d/d

Re: Index Event Properly

mloven_splunk — Mon, 28 Sep 2020 14:27:59 GMT

Nope. You're (kinda) mixing up BREAK_ONLY_BEFORE and TIME_FORMAT.

BREAK_ONLY_BEFORE is a regex field. Use something like:

BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

Re: Index Event Properly

shangshin — Tue, 30 Jul 2013 16:49:22 GMT

Thank you for the useful answer.