I am trying to setup a new linebreak for SUN IDM Server.log and the log outputs the following:
[#|2014-07-21T11:32:02.192-0700|INFO|sun-appserver2.1.1|ShoalLogger|_ThreadID=13;_ThreadName=ViewWindowThread:HACluster;|Adding Join member: HAInstance02 group: HACluster StartupState:INSTANCE_STARTUP|#]
I am new to Splunk and still learning. Any help would be greatly appreciated.
Try this in props.conf for your sourcetype on indexer/heavyforwarder.
[YourSourceType]
BREAK_ONLY_BEFORE=^\[#
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d%%H:%M:%S.%3Q%z
TIME_PREFIX=\[#\|
Try this in props.conf for your sourcetype on indexer/heavyforwarder.
[YourSourceType]
BREAK_ONLY_BEFORE=^\[#
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d%%H:%M:%S.%3Q%z
TIME_PREFIX=\[#\|
Thank you!