ESXi Events Splitting line by line

[ironalsa]

Splunk is splitting each line into an event instead of grouping the whole block as one event. I've tried a few fixes for this host in C:\Program Files\Splunk\etc\system\local\props.conf. (I removed the actual IP below and replaced it with "hostname")

My ESXi host's hostd logs on the host look like below:

---

2016-08-08T19:16:29.145Z [3C481B70 error 'SoapAdapter']
--> Required parameter querySpec is missing
-->
--> while parsing call information for method QueryPerf
--> at line 1, column 285
-->
--> while parsing SOAP body
--> at line 1, column 271
-->
--> while parsing SOAP envelope
--> at line 1, column 38
-->
--> while parsing HTTP request for method queryStats
--> on object of type vim.PerformanceManager
--> at line 1, column 0

---

My props.conf additions look like the below:

This did nothing - events came in the same
[host::hostname]
BREAK_ONLY_BEFORE_DATE = true
SHOULD_LINEMERGE = true

No difference once again
[host::hostname]
TIME_PREFIX = (\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z)
BREAK_ONLY_BEFORE_DATE = true
SHOULD_LINEMERGE = true

This one removed the dates, but still broke it out on each line
[host::hostname]
LINE_BREAKER = (\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z)

Any ideas what I can do next? It seems like Splunk is finding a timestamp on each line, but I don't see where it's getting that.

Thanks!

[Jeremiah]

Is the IP address what you see in the host field when you search your esxi log data? Thats the value you have to put into the hostname in [host::hostname]. You might want to consider just using a sourcetype instead, that way any esxi logs can be treated the same way.

Try this:

[host::hostname]
LINE_BREAKER=(\v+)(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}
SHOULD_LINEMERGE=False
TIME_FORMAT=%FT%H:%M:%S.%3N
TIME_PREFIX=^