Breaking the logs with timestamp

[kiran331]

Hi

How to break following logs with time-stamp. Here the timestamp; "Jul 15 13:54:20"

Jul 15 13:58:47 10.21.29.227 msg=Veri Jul 15 13:54:20Cyber-Ark|Vault|9.60.0000|295|Retrieve password|5|act=Retrieve password suser=PasswordManager fname=Root\Operating System-WinDomain-AD dvc= shost=1.2.3.4 dhost=abc.com duser=ADM externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=XYZ cs3Label="Device Type" cs3=Operating System cs4Label="Database" cs4= cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=CPM msg=CPMJul 15 13:54:21 CEF:0|Cyber-Ark|Vault|9.60.0000|295|Retrieve password|5|act=Retrieve password suser=PasswordManager fname=Root\Operating System-WinDomainAD dvc= shost=1.3.4.4 dhost=abc.com duser=AD externalId=

[rafamss · Accepted solution]

Your LINE_BREAKER parameter could be like this: (\w{3})\s(\d{2})\s(\d{2}):(\d{2}):(\d{2})

See more in: http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Configureeventlinebreaking

[somesoni2]

Can you provide samples on how the events should look after splitting?

[kiran331]

Jul 15 13:54:20Cyber-Ark|Vault|9.60.0000|295|Retrieve password|5|act=Retrieve password suser=PasswordManager fname=Root\Operating System-WinDomain-AD dvc= shost=1.2.3.4 dhost=abc.com duser=ADM externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=XYZ cs3Label="Device Type" cs3=Operating System cs4Label="Database" cs4= cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=CPM msg=CPM

Jul 15 13:54:21 CEF:0|Cyber-Ark|Vault|9.60.0000|295|Retrieve password|5|act=Retrieve password suser=PasswordManager fname=Root\Operating System-WinDomainAD dvc= shost=1.3.4.4 dhost=abc.com duser=AD externalId=