How to correctly configure timestamp extraction?

[hans]

Here is a sample log:

2010-05-06 16:41:18,082 INFO SplunkCLI :: Executing: "/Users/hs/bin/"  status space  

    Thu May  6 16:40:42 2010                    1              unknown  /var/folders/0g/0g2PnEjcEOeS9P-W4W4aIQkTMTmp9142.txt
---------------------------------------
Collapse files into common directories?
---------------------------------------
                                       Enter [Y]es or [N]o > 
------------------------------
Index found files into splunk?
------------------------------
                             Enter choice: All/Some/[None] > 0
2010-05-06 16:41:54,364 INFO splunk_data :: report_item_fspath='/Users/hstest_find_ascii' file_name='test_found.py' test_name='test_find_ascii' test_result='PASSED' error_message=''
2010-05-06 16:41:54,364 INFO conftest :: RUNTEST_TEARDOWN test_ascii runtime=163

Currently splunk sees this as two events:

2010-05-06 16:41:18,082 ...
    Thu May  6 16:40:42 2010 ...

How can I correctly extract the timestamp to turn the sample log above as three events?

2010-05-06 16:41:18,082 ...
2010-05-06 16:41:54,364 ...
2010-05-06 16:41:54,364 ...

My props.conf in etc/apps/my-app/local/props.conf looks like this:

[sourcetype::testlog]
MAX_TIMESTAMP_LOOKAHEAD = 25

[marcoscala]

Simon gave the best answer.

First of all, you have to tell Splunk that this is a multi line event, and then when the log should be broken into an event. In your case use this directive in props.conf:

[source::testlog]
BREAK_ONLY_BEFORE_DATE = true

Honestly I'm not 100% sure and I would check if the second line is considered an event-breaker or not.

Regards, Marco Scala - Consoft

[Simon_Shelston]

This appears to be a line breaking issue.

Try adding the following to props.conf:

BREAK_ONLY_BEFORE_DATE = true