topic Re: Parsing not working as expected in Splunk Search

Parsing not working as expected

a508184 — Wed, 06 Apr 2022 02:52:54 GMT

New to splunk, need your help.

Data:

a508184_0-1649213303857.png

12/15/2022 is taking as 2/15/22. Below is the props.conf am using it.

SHOULD_LINEMERGE=true
LINE_BREAKER=([/r/n]*)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M
TZ=EST
TIME_PREFIX =^
BREAK_ONLY_BEFORE=[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M

Can you please help me to get the correct parsing? Thanks in advance.

Re: Parsing not working as expected

venkatasri — Wed, 06 Apr 2022 03:16:32 GMT

Your TIME_PREFIX = ^ that means starting of the event, what you have highlighted is not being considered as _time for that reason.

When you set TIME_PREFIX alone, starting of the event is 4/5/2022 9:02 PM assuming line_breaking is fine.

you should look at TIME_FORMAT and set the TIME_PREFIX correctly for the timestamp you want to consider for _time.

The screenshot and events pasted looks completely different.

Re: Parsing not working as expected

VatsalJagani — Wed, 06 Apr 2022 06:11:37 GMT

Using SHOULD_LINEMERGE=true is performance ineffective. Use the below configuration.

SHOULD_LINEMERGE = false LINE_BREAKER = ([\s\n\r]+)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M\s+ TZ = EST TIME_PREFIX = ^ TIME_FORMAT = %m/%d/%Y %I:%M %p MAX_TIMESTAMP_LOOKAHEAD = 25

By the looks of it from the data you pasted, it is not necessary to have all the events in a new line. But if that is the case (each event in a new line) then updating the LINE_BREAKER below will improve performance and reduce the chances of incorrect line-breaking.

([\n\r]+)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M\s+

I hope this helps!!!