How to write the correct TIME_FORMAT and LINE_BREAKER for my sample data?

[saifuddin9122]

Hello all,

i have a log file in which there is no date in the log events and it might also contain stack-trace

Here is the sample log event

"03:37:10,530 [localhost-startStop-1] ERROR com.user.conf.TransformationConfiguration  - No license file found on location 
09:43:25,886 [http-nio-8080-exec-2] ERROR com.bp3.ServiceImpl  - Unable to resolve Username. 
09:43:26,291 [http-nio-8080-exec-3] ERROR com.bp3.CookieServiceImpl  - Error tenant not available or User not created.
09:43:26,291 [http-nio-8080-exec-5] ERROR com.bp3.authenticationService  - Unable to authenticate.
      at com.sun.proxy.$Proxy88.flush(Unknown Source)
        at org.springframework.data.jpa.repository.support.SimpleJpaRepository.flush(SimpleJpaRepository.java:441)
        at sun.reflect.GeneratedMethodAccessor849.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.executeMethodOn(RepositoryFactorySupport.java:442)
        at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.doInvoke(RepositoryFactorySupport.java:427)
        at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.invoke(RepositoryFactorySupport.java:381)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.data.repository.core.support.RepositoryFactorySupport$DefaultMethodInvokingMethodInterceptor.invoke(RepositoryFactorySupport.java:512)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:136)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.data.jpa.repository.support.CrudMethodMetadataPostProcessor$CrudMethodMetadataPopulatingMethodIntercceptor.invoke(CrudMethodMetadataPostProcessor.java:122)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:207)"

so i wrote my props.conf as :

[mytest]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %H:%M:%S,%3N
LINE_BREAKER = ([\r\n]+)

but no luck. can any one help me as i don't know where am doing mistake.

[woodcock]

You really need to have the generating entity updated to put in the date, too (not just the time of day). This should work:

[mytest]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 12
TIME_FORMAT = %H:%M:%S,%3N
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE_DATE=true

Make sure that your events have a souretype of EXACTLY mytest (case matters), deploy this to the indexing entity (HFs or Indexers) and restart all Splunk instances there and then verify the change by checking ONLY those events that were forwarded AFTER the restarts.

[somesoni2]

Give this a try

[mytest]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)(?=\d+\:\d+\:\d+,\d+)
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %H:%M:%S,%3N

[adonio]

is this one event?
how would you like to see the following in splunk?
here is an answer that helps a similar issue:
https://answers.splunk.com/answers/833/how-does-splunk-determine-the-date-when-there-is-no-date-stam...