Dashboards & Visualizations

multiline events

isha_ish
Engager

Am getting multiline events. below events should be shown separately for each time. how to fix this . on my props.conf i have the below config. but it isn't working

BREAK_ONLY_BEFORE_DATE=true
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 24

14/10/2020
19:46:58.035
 
2020-10-14T19:46:58.035+01:00 INFO [r] (default task-11) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx]
2020-10-14T19:46:58.035+01:00 INFO [] (default task-82) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx]
2020-10-14T19:46:58.035+01:00 INFO [] (default task-11) User token loaded. [windowsId=null,internal=false,externalOrigin=false,status=TOKEN_IS_NULL_OR_EMPTY] 2020-10-14T19:46:58.035+01:00 INFO [sso.AuthFilter
Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The events aren't matching the TIME_FORMAT setting.  Try these settings

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The events aren't matching the TIME_FORMAT setting.  Try these settings

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

isha_ish
Engager

Multiline events are solved now. but the line which should be on multiline like the postman commands and the result are also coming in separate line. any way to fix it ?

 

 15/10/2020
06:06:16.069
 
1875094 < Transfer-Encoding: chunked
 15/10/2020
06:06:16.069
 
1875094 < Server: Apache-Coyote/1.1
 15/10/2020
06:06:16.069
 
1875094 < Date: Thu, 15 Oct 2020 05:06:15 GMT
 15/10/2020
06:06:16.069
 
1875094 < Content-Type: application/json;charset=UTF-8
0 Karma

to4kawa
Ultra Champion

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

I think it's OK.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!