Getting Data In

Line breaker to break the events

raju_dara
New Member

Below is the app log content and the configuration parameters in props.conf. Not sure what is going wrong.. Output is all messed up and I dont see the events getting generated seperatly.. Any help??

11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

TRUNCATE=240000
TIME_PREFIX = ^Timestamp:\s
TIME_FORMAT= %m/%d/%Y %H:%M:%S
LINE_BREAKER = ([\r\n]+)(?=Timestamp:\s)
SHOULD_LINEMERGE=false

This is what I am expecting on SPLUNK
Event One
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

Event two

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

Event three..

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.

0 Karma

raju_dara
New Member

That did the knack.. Thank you soo much..

0 Karma

lguinn2
Legend

You do not need a time prefix or a line breaker. Try

TRUNCATE=240000 
TIME_FORMAT= %m/%d/%Y %H:%M:%S 
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE_DATE = true

You don't actually need the last 2 lines either, as these are the defaults. And MAX_TIMESTAMP_LOOKAHEAD is just for efficiency.

0 Karma

raju_dara
New Member

Below is the output.. Last 3 lines should be part of Event2..

Event 1
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event 2
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
Event 3
;ZZZZ
Event 4
;ZZZY

0 Karma

raju_dara
New Member

Thank you but no luck.. :(.. Any more suggestions??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...