Getting Data In

If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

sfilipov
New Member

We have divider of logs as DateTime value. If Splunk forwarder sees DateTime value in the string, it forms other log-records in the server. Look at the screenshot: we can see 2 parts of one log, but we need whole 1 log

Thanx 🙂

alt text

Tags (2)
0 Karma

harsmarvania57
Ultra Champion

Hi @sfilipov,

You can set below configuration on Indexer or Heavy Forwarder which ever comes first from Universal Forwarder to parse timestamp correctly and break line properly and then restart splunk on Indexer or Heavy Forwarder.

props.conf

[yoursourcetype]
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%:z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=29
0 Karma

sfilipov
New Member

not working for me 😞 maybe because sourcetype contains '-' symb?

    [evenue-raw]
    TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%:z
    TIME_PREFIX=^
    MAX_TIMESTAMP_LOOKAHEAD=29
0 Karma

harsmarvania57
Ultra Champion

No, I don't think so - in sourcetype will create problem. How Universal Forwarder is sending data to Indexers (Directly to Indexer OR via Heavy Forwarder)? On which server you implemented above config and have you restarted splunk after changes (Data which is already indexed in splunk will not change, only new data will parse and index properly)?

0 Karma

493669
Super Champion

Add below stanza in props.conf

[<yoursourcetypeName>]
MAX_TIMESTAMP_LOOKAHEAD = 20
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = ^
0 Karma

493669
Super Champion

connverted to comment as @harsmarvania57 answer is more correct

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...