Helps with Props For Sample Logs

[Ram2]

Sample logs:

Mon Sep 04 13:23:40 2024 -- (eMonitoringLATN_install.sh) Your current directory is [/d/onedemand/etc]

Mon Sep 05 12:21:30 2024 -- (eMonitoringLATN_install.sh) Final Destination reached logs.

Mon Sep 06 12:21:30 2024 -- (eMonitoringLATN_install.sh) logs ingestion started.

We tried below props for above sample logs but line breaking not happening correctly.  And pls let us know how to give time format as well.

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\w+\s\w+\s\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}
TIME_PREFIX=^

[inventsekar]

Hi @Ram2 
Same questions of @PickleRick :

Looks like you are reading app logs from linux, thru Splunk UF (or HF)

1) pls confirm are you using UF or HF (or directly reading at indexer?)

2) are you ingesting these logs thru some Splunk TA / App / Add-on's?

[Ram2]

Looks like you are reading app logs from linux, thru Splunk UF (or HF)  yes from Splunk UF

1) pls confirm are you using UF or HF (or directly reading at indexer?) using UF

2) are you ingesting these logs thru some Splunk TA / App / Add-on's? No

[inventsekar]

Hi @Ram2 ...May i know what happens when you try this props:

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
TIME_PREFIX=^

[PickleRick]

1. How are you ingesting your events?

2. Where (on which component) did you put these settings?1