Getting Data In

How to refine our sourcetype configuration for proper line breaking of events that contain multiple date values?

SplunkTrust
SplunkTrust

We are having problems parsing lines with timestamps at the beginning of the line but then there are other fields that are also dates.

We are using Splunk 6.4.2 by the way and MOST of the time the lines are parsed correctly but not every time.

Here's a sample event line

2016-10-28 00:11:28 Foo table info: table = MyTable, baselineDate = 2016-10-27 23:00:00, baselineOldDate = 2016-10-26 23:00:00, baselineSize = 596503557, baselineOldSize = 596446556, frequency = 1 day, 0:00:00, previousDate = 2016-10-27 19:00:00, penultimateDate = 2016-10-26 19:00:00,

And here is the sourcetype definition on the indexers

SHOULD_LINEMERGE        = True
TIME_PREFIX             = ^
TIME_FORMAT             = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 20
LINE_BREAKER            =  ([\r\n]+)
TRUNCATE                =  10000
BREAK_ONLY_BEFORE       = ^\d\d\d\d-\d+-\d+\s+\d\d:\d\d:\d\d
NO_BINARY_CHECK         = True
TZ                      = UTC

The source is:

2016-10-28 00:11:28 Foo table info: table = MyTable, baselineDate = 2016-10-27 23:00:00, baselineOldDate = 2016-10-26 23:00:00, baselineSize = 596503557, baselineOldSize = 596446556, frequency = 1 day, 0:00:00, previousDate = **2016-10-27 19:00:00**, penultimateDate = 2016-10-26 19:00:00,

What happens is that I occasionally get two events instead of one for that line

2016-10-28 00:11:28 Foo table info: table = MyTable, baselineDate = 2016-10-27 23:00:00, baselineOldDate = 2016-10-26 23:00:00, baselineSize = 596503557, baselineOldSize = 596446556, frequency = 1 day, 0:00:00, previousDate = 2016-10-27 19

0, penultimateDate = 2016-10-21 00:00:00,

So what is happening is that most comes through but starting at previousDate = 2016-10-27 19:00:00 this is split and we only get up to "19" on one line and then the next event starts with a zero. So Splunk is splitting the line.

Any refinements on my sourcetype?

0 Karma

Influencer

You have both BREAKONLYBEFORE and LINEBREAKER defined. Ditch BREAKONLYBEFORE and change SHOULDLINEMERGE to false.

0 Karma