Can not parse timestamp

[kennmunklarsen]

I have a problem with this file:

-----------------------------------
CLIENT                        100
GUID                          4F281780E49E1DC0E10080000A1E8680
INPUT_DATA                    SAP_SYSTEM=LD1;SAP_CLIENT=100;TITLE=Visning af tatusrecord;Function code that PAI triggered=BACK;WE02.SAPLEDI5.0100.SAPLEDI5.0100.EDI_INTDS.DOCNUM[0]()=0000000000049301;
OUTPUT_DATA                   SAP_SYSTEM=LD1;SAP_CLIENT=100;
CREATED_AT                    20120201123559
CREATED_BY                    SZT
CHANGED_AT                    20120201123559
CHANGED_BY                    SZT
TIMESTAMP                     20120201093938
TRX_NAME                      WE02
USERNAME                      SZT
CLIENT_PC                     172.28.240.189
TECHNOLOGY                    10
----------------------------------------

I use the following configuration:

BREAK_ONLY_BEFORE=^CLIENT\s+\d{3}
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=14
TIME_FORMAT=%Y%m%d%H:%M:%S
TIME_PREFIX=TIMESTAMP\s+

But it is like Splunk reads to much into the timestamp even though I use “MAX_TIMESTAMP_LOOKAHEAD=14”

Splunk reports this error.
-Could not use strptime to parse timestamp from "20120201093938\nTRX_NAME WE02\nUSERNAME SZT\n
CLIENT_PC"

Hope some one can help me

[sowings]

Your TIME_FORMAT specifies colons; the time stamp I can see from your event sample doesn't have any. Try %Y%m%d%H%M%S.

[Drainy]

Splunk is quite clever, sometimes its better to let it try and handle as much as possible, using the data above the following props performs the multiline extraction and timestamping correctly;

BREAK_ONLY_BEFORE=CLIENT\s+
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_PREFIX=TIMESTAMP

[Drainy]

Who knows! I didn't have time to test it. Sometimes in Splunk if you try to be too specific you can end up with conflicting configurations that try to do things in different orders. There are probably a few wonky bits 🙂 Feel free to click the tick next to my answer to accept if its all working now!

[kennmunklarsen]

It works!, but why did the other configuration not work?