Getting Data In

How to edit my props.conf to line break before each timestamp in my multi line events?

jarapally
Explorer

Hi,

I have logs with multi line events and I am trying to line break before the timestamp, but before date there is -}",. Can you help me write the props.conf so the line breaks before the date?

2/2/2017 6:29:59 PM
"{1:F01HKHHAXXX0000000000}{2:I103SCBLHKHHXXXXN}{3:{108:1A1DF41E61005916}}{4:
:20:1A1DF41E61005916
:23B:CRED
:32A:170202HKD442455,64
:33B:HKD442455,64
:50K:/XXX SETTLEMENTS
ABC LIMITED
ADDRESS1
CITY,STATE,PROVINCE,COUNTRY
:53A:/44700839456
JEFFGB2XXXX
:59A:/44700388721
US33XXX
:71A:OUR
:72:/BNF/ HK COMM DIFF VD

-}",2/2/2017 6:29:59 PM
"{1:F01US33ABCH0000000000}{2:I210CHASGB2LXXXXN}{3:{108:54455B4301215800}}{4:
:20:54455B4301215800
:25:0077008324
:30:170203
:21:54455B4301215800
:32B:TRY120000,00
:52D:/FXX25703
ABCBANK
ADDRESS1
CITY,STATE,PROVINCE,COUNTRY
0 Karma

mpreddy
Communicator

use this attribute in props.conf

BREAK_ONLY_BEFORE = -}
* When set, Splunk creates a new event only if it encounters a new line that
matches the regular expression.
* Defaults to empty.

0 Karma

jarapally
Explorer

That did not work

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...