Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to define a file input for my data?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Our application has a very readable, but quite unindexable format. Currently, its coming in as multiple lines, which is making my search results a bear to deal with. The format looks like this:
Entering:
Client:ClientCompanyName
LoggedInUser:me@me.com
Class:SurveyDAO
Method:isAdminUser(me@me.com)
StartTime: 2015-01-30 00:54:44 678
Query:select adminFlag from Accounts where id= ?
EndTime:2015-01-30 00:54:44 990
Anyone provide some help in defining a decent file input for that?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need put configuration similar to below in props.conf against the sourcetype
props.conf
[sourcetype]
SHOULD_LINEMERGE=TRUE
BREAK_ONLY_BEFORE = Entering:
TIME_FORMAT = %Y-%m-%d %H:%M:%S %3N
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = StartTime:
Note: I have not tested it and it should work fine.
The above configure merges the multi lines event into single line and break the individual event at "Entering:"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need put configuration similar to below in props.conf against the sourcetype
props.conf
[sourcetype]
SHOULD_LINEMERGE=TRUE
BREAK_ONLY_BEFORE = Entering:
TIME_FORMAT = %Y-%m-%d %H:%M:%S %3N
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = StartTime:
Note: I have not tested it and it should work fine.
The above configure merges the multi lines event into single line and break the individual event at "Entering:"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Worked like a charm!!! Thanks!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Mile High Learning with Splunk University, Denver, Colorado
IT Service Intelligence 5.0 Series: Your Guide to the June Launch
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
