How to setup linebreak and parse SUN IDM Server.log?

[csunllopez]

I am trying to setup a new linebreak for SUN IDM Server.log and the log outputs the following:

[#|2014-07-21T11:32:02.192-0700|INFO|sun-appserver2.1.1|ShoalLogger|_ThreadID=13;_ThreadName=ViewWindowThread:HACluster;|Adding Join member: HAInstance02 group: HACluster StartupState:INSTANCE_STARTUP|#]

I am new to Splunk and still learning. Any help would be greatly appreciated.

[somesoni2 · Accepted solution]

Try this in props.conf for your sourcetype on indexer/heavyforwarder.

[YourSourceType]
BREAK_ONLY_BEFORE=^\[#
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d%%H:%M:%S.%3Q%z
TIME_PREFIX=\[#\|

[csunllopez]

Thank you!