can anyone help us to figure out magic six for the below sample log?
SHOULD_LINEMERGE= LINE_BREAKER= MAX_TIMESTAMP_LOOKAHEAD= TIME_PREFIX= TRUNCATE= TIME_FORMAT=
VersionNumber=7.2 build 13. Maint HF-005,Priority=N/A,LocalTranNumber=I32790D942,RemoteTranNumber=N/A,TransferStartTime=003940,TransferStartDate=20190327,
Thanks in Advance!
What have you tried so far and what problems are you running into? This is a platform for asking questions, not for asking other people to do your job for you 🙂
The "magic six" are usually defined by you or whomever knows the data. Essentially, you are telling Splunk where to break the events and how to identify the timestamps for indexing.
I suggest you do this;
Just looking at that event, the TIMEFORMAT might look like this:
`TIMEPREFIX = TransferStartTime=
TIME_FORMAT = %H%M%S,TransferStartDate=%Y%m%d`
You may not HAVE to use everything form the Magic 6, but you should try to if you can.
What I usually do is bring in sample data into a standalone instance (usually running on my laptop) and use the "Add Data" ability to bring in the data and test out props before I deploy them out.
Hi @EHariharan ,
The answer provided by @ragedsparrow is how you should approach data onboarding. However, if you're the one tasked with owning the data, and you're just given some events you might try these values:
SHOULDLINEMERGE = false
LINEBREAKER = ([\r\n]+)
TIMEPREFIX = TransferStartTime=
TIMEFORMAT = %H%M%S,TransferStartDate=%Y%m%d
TRUNCATE = 10000
MAXTIMESTAMPLOOKAHEAD = 40