Getting Data In

How to refine our sourcetype configuration for proper line breaking of events that contain multiple date values?

burwell
SplunkTrust
SplunkTrust

We are having problems parsing lines with timestamps at the beginning of the line but then there are other fields that are also dates.

We are using Splunk 6.4.2 by the way and MOST of the time the lines are parsed correctly but not every time.

Here's a sample event line

2016-10-28 00:11:28 Foo table info: table = MyTable, baselineDate = 2016-10-27 23:00:00, baselineOldDate = 2016-10-26 23:00:00, baselineSize = 596503557, baselineOldSize = 596446556, frequency = 1 day, 0:00:00, previousDate = 2016-10-27 19:00:00, penultimateDate = 2016-10-26 19:00:00,

And here is the sourcetype definition on the indexers

SHOULD_LINEMERGE        = True
TIME_PREFIX             = ^
TIME_FORMAT             = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 20
LINE_BREAKER            =  ([\r\n]+)
TRUNCATE                =  10000
BREAK_ONLY_BEFORE       = ^\d\d\d\d-\d+-\d+\s+\d\d:\d\d:\d\d
NO_BINARY_CHECK         = True
TZ                      = UTC

The source is:

2016-10-28 00:11:28 Foo table info: table = MyTable, baselineDate = 2016-10-27 23:00:00, baselineOldDate = 2016-10-26 23:00:00, baselineSize = 596503557, baselineOldSize = 596446556, frequency = 1 day, 0:00:00, previousDate = **2016-10-27 19:00:00**, penultimateDate = 2016-10-26 19:00:00,

What happens is that I occasionally get two events instead of one for that line

2016-10-28 00:11:28 Foo table info: table = MyTable, baselineDate = 2016-10-27 23:00:00, baselineOldDate = 2016-10-26 23:00:00, baselineSize = 596503557, baselineOldSize = 596446556, frequency = 1 day, 0:00:00, previousDate = 2016-10-27 19

0, penultimateDate = 2016-10-21 00:00:00,

So what is happening is that most comes through but starting at previousDate = 2016-10-27 19:00:00 this is split and we only get up to "19" on one line and then the next event starts with a zero. So Splunk is splitting the line.

Any refinements on my sourcetype?

0 Karma

twinspop
Influencer

You have both BREAK_ONLY_BEFORE and LINE_BREAKER defined. Ditch BREAK_ONLY_BEFORE and change SHOULD_LINEMERGE to false.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...