Issue with line breaker

[mahesh27]

Props used:

[sql:logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n])\[\w{3}\s\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\sEDT\s\d{4}\]
TIME_PREFIX=\{
TIME_FORMAT=%a %b %d  %H:%M:%S EDT %Y

While using above props only 2 digits date( Aug 25, Aug 28) is getting extracted, but not single digit date(Aug 2, Aug 5).

How to modify line breaker so that it can take both the logs.
Any help would be appreciated. 

[Mon Aug 5 12:18:04 EDT 2024] - Sql error code and message returned from store procideure: No SQL error found.

[Mon Aug 2 12:18:04 EDT 2024] - Sql error code and message returned from store procideure: No SQL error found.

[Mon Aug 25 12:18:04 EDT 2024] - Sql error code and message returned from store procideure: No SQL error found.

[Mon Aug 28 12:18:04 EDT 2024] - Sql error code and message returned from store procideure: No SQL error found.

[richgalloway]

LINE_BREAKER does not extract timestamps.  That's what TIME_FORMAT does.

There seems to be two issues here:

1. Lines not breaking correctly when the date is a single digit.
2. Timestamps not extracted correctly when the date is a single digit.

There's a separate setting for each.

The line breaker is telling Splunk the next event must have a two-digit year so that is what Splunk does.  To make the date 1 or 2 digits, modify the regex:

([\r\n])\[\w{3}\s\w{3}\s\d{1,2}\s\d{2}:\d{2}:

or keep it simple with

([\r\n])\[\w{3}\s\w{3}

The latter regex has the advantage of handling any time zone.

The %d formatting variable accepts both one- and two-digit dates.  I believe the problem with the formatting string is the extra space after "%d".

Here's the final set of props.

[sql:logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n])\[\w{3}\s\w{3}\s\d{1,2}\s\d{2}:\d{2}:\d{2}\s\w{3}\s\d{4}\]
TIME_PREFIX=\{
TIME_FORMAT=%a %b %d %H:%M:%S %Z %Y