Line breaker to break the events

[raju_dara]

Below is the app log content and the configuration parameters in props.conf. Not sure what is going wrong.. Output is all messed up and I dont see the events getting generated seperatly.. Any help??

11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

TRUNCATE=240000
TIME_PREFIX = ^Timestamp:\s
TIME_FORMAT= %m/%d/%Y %H:%M:%S
LINE_BREAKER = ([\r\n]+)(?=Timestamp:\s)
SHOULD_LINEMERGE=false

This is what I am expecting on SPLUNK
Event One
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

Event two

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

Event three..

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

[martin_mueller · Accepted solution]

You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.

[raju_dara]

That did the knack.. Thank you soo much..

[lguinn2]

You do not need a time prefix or a line breaker. Try

TRUNCATE=240000 
TIME_FORMAT= %m/%d/%Y %H:%M:%S 
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE_DATE = true

You don't actually need the last 2 lines either, as these are the defaults. And MAX_TIMESTAMP_LOOKAHEAD is just for efficiency.

[raju_dara]

Below is the output.. Last 3 lines should be part of Event2..

Event 1
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event 2
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
Event 3
;ZZZZ
Event 4
;ZZZY

[raju_dara]

Thank you but no luck.. :(.. Any more suggestions??