How do I configure line breaking on the timestamp in my data?

[tkwaller]

Need to line break on timestamp in the following log record, but the underscore in the timestamp is throwing me off. Any help would be appreciated and thank you!

2015-07-28_09:51:02 INFO App=EXTRACT_HIT_DATA Message=::' Checking for backlog file/files to process '
2015-07-28_09:51:02 INFO App=EXTRACT_HIT_DATA Message=:' Number of backlog files : 48'
2015-07-28_09:51:02 INFO App=EXTRACT_HIT_DATA Message=:' Start processing all available backlog files '
2015-07-28_09:51:02 WARNING App=EXTRACT_HIT_DATA Message=:' File /nas/abc/myx/myarchive/omniture/feed/.../xyz.fin still not available, will try to process the file again during next run.'
2015-07-28_09:51:02 WARNING App=EXTRACT_HIT_DATA Message=:' File /nas/abc/myx/myarchive/omniture/feed/.../xyz.fin still not available, will try to process the file again during next run.'
2015-07-28_09:51:02 WARNING App=EXTRACT_HIT_DATA Message=:' File /nas/abc/myx/myarchive/omniture/feed/.../xyz.fin still not available, will try to process the file again during next run.'

[jnussbaum_splun · Accepted solution]

you'll want to create a props.conf file that sits with your inputs.conf file. - Change "yoursourcetype" to the sourcetype you've defined in inputs.conf
[yoursourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 20
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%d_%H:%M:%S
TIME_PREFIX = ^

[tkwaller]

Will that break at timestamp?
I think the lookahead and no linemerge would allow it to break properly is that correct?

[wdsjon]

Yep - Splunk will automatically break on the timestamp unless you manually define a line breaker.

[bmacias84]

Within your props.conf you need to specify the ** TIME_FORMAT**.

#props.conf
[mysource]
TIME_FORMAT =  < strptime >

Use this reference Configuretimestamprecognition

[tkwaller]

So what would that make LINE_BREAKER look like then or should I use it? Considering I need to break on timestamp.