Getting Data In

Can you help me with props.conf in line breakage?

vrmandadi
Builder

link textI want to break the events where you see the bolded timestamps below, like 12:17:50.267,12:17:50.268 etc

Below is the sample event

12:17:50.267 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Preprocessing of job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING} done.12:17:50.268 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Transaction started for job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING}.12:17:50.382 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING} done.

i am using the below props.conf

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\d{2}\:\d{2}\:\d{2}\.\d{3}
0 Karma

vrmandadi
Builder

I got it using line breaker helped

DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
LINE_BREAKER=(\d{2}:\d{2}:\d{2}.\d{3})

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
try this

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=(\d{2}\:\d{2}\:\d{2}\.\d{3})

Bye.
Giuseppe

0 Karma

vrmandadi
Builder

It did not break,I will attach the raw data file in the question to see if that works ad that is the same thing I posted in the question

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
modify the regex in

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=(\d+:\d+:\d+\.\d+\s\[)

Bye.
Giuseppe

0 Karma

ssadanala1
Contributor

Here is props.conf for the File

SHOULD_LINEMERGE=false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{3}
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
TIME_FORMAT = %H:%M:%S.%3Q
" Test and Validate before deploying"

Cheers

0 Karma

vrmandadi
Builder

I tested it,it is not working

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @vrmandadi,

Could you be more clear about what you need help with? Thanks for posting!

0 Karma

vrmandadi
Builder

I want to break the events where you see the timestamp like 12:17:50.267,12:17:50.268 etc

0 Karma

vrmandadi
Builder

Am I clear or do I need to add more information

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...