How to write regex to create new events before a certain time format?

[rameshlpatel]

Hi,

Please some help me to create new event if i find HH:MM:SS time format in logs for sourcetype perfLog.

I have used below configuration in props.conf file inside Indexer /opt/splunk/etc/system/local dir.

[sourcetype::perfLog]
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE=^(?:\d|[01]\d|2[0-3]):[0-5]\d$

But still it did not work. Below are the example of logs.

08:11:13 |INFO | | LoggingHandler | ausu512a.wm.com|{http://esb.wm.com/service/getCustAccountInfo}getCustAccountInfo|getCustAccountInfo|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|244| MS |ESB CALL|TRANSACTION ID|2934447739687911190|
08:11:13 |DEBUG | | Profiler | ausu512a.wm.com|class com.wm.css.payment.dao.impl.PayTransactionDaoImpl|List com.wm.css.payment.dao.PayTransactionDao.getPaymentDetailsForAccount(String)|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|26| MS |
08:11:13 |DEBUG | | Profiler | ausu512a.wm.com|class com.wm.css.payment.service.impl.PaymentServiceImpl|List com.wm.css.payment.service.PaymentService.getPaymentDetailsForAccount(String)|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|26| MS |

[somesoni2]

Try this

BREAK_ONLY_BEFORE=^\d{2}:\d{2}:\d{2}\s\|

[Ayn]

My advice would be to use www.regexr.com or similar to find a correct one 🙂 Otherwise I'd just help you this once and you wouldn't learn anything.

[richgalloway]

Try changing the BREAK_ONLY_BEFORE statement to 'LINE_BREAKER=([\r\n]+)(\d\d:\d\d:\d\d)'.

[rameshlpatel]

Yes. I did

[richgalloway]

Did you restart Splunk?

[rameshlpatel]

Thanks but its not working.

[rameshlpatel]

Help to create regex for same please ?

[Ayn]

Your regex isn't matching, so...

You're looking for ^(?:\d|[01]\d|2[0-3]):[0-5]\d$ and I don't see that matching anything in your sample events.