multiline events

[isha_ish]

Am getting multiline events. below events should be shown separately for each time. how to fix this . on my props.conf i have the below config. but it isn't working

BREAK_ONLY_BEFORE_DATE=true
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 24

14/10/2020 19:46:58.035

2020-10-14T19:46:58.035+01:00 INFO [r] (default task-11) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx] 2020-10-14T19:46:58.035+01:00 INFO [] (default task-82) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx] 2020-10-14T19:46:58.035+01:00 INFO [] (default task-11) User token loaded. [windowsId=null,internal=false,externalOrigin=false,status=TOKEN_IS_NULL_OR_EMPTY] 2020-10-14T19:46:58.035+01:00 INFO [sso.AuthFilter

[richgalloway · Accepted solution]

The events aren't matching the TIME_FORMAT setting.  Try these settings

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false

[isha_ish]

Multiline events are solved now. but the line which should be on multiline like the postman commands and the result are also coming in separate line. any way to fix it ?

	15/10/2020 06:06:16.069	1875094 < Transfer-Encoding: chunked host = lonrsxxx index = agile-xxx source = /exxx sourcetype = amservices-log splunk_server = lonrsxxx
	15/10/2020 06:06:16.069	1875094 < Server: Apache-Coyote/1.1 host = lonrsxxx index = agile-xxxx source = /exxx sourcetype = amservices-log splunk_server = lonrxxxx
	15/10/2020 06:06:16.069	1875094 < Date: Thu, 15 Oct 2020 05:06:15 GMT host = lonrs1xxx index = agile-main source = /exxxx sourcetype = amsexxx splunk_server = lonrsxxxx
	15/10/2020 06:06:16.069	1875094 < Content-Type: application/json;charset=UTF-8

[to4kawa]

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

I think it's OK.