Below is the app log content and the configuration parameters in props.conf. Not sure what is going wrong.. Output is all messed up and I dont see the events getting generated seperatly.. Any help??
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
;ZZZZ
;ZZZY
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1
;ZZRZ
;ZZRY
TRUNCATE=240000
TIME_PREFIX = ^Timestamp:\s
TIME_FORMAT= %m/%d/%Y %H:%M:%S
LINE_BREAKER = ([\r\n]+)(?=Timestamp:\s)
SHOULD_LINEMERGE=false
This is what I am expecting on SPLUNK
Event One
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event two
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
;ZZZZ
;ZZZY
Event three..
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1
;ZZRZ
;ZZRY
You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.
You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.
That did the knack.. Thank you soo much..
You do not need a time prefix or a line breaker. Try
TRUNCATE=240000
TIME_FORMAT= %m/%d/%Y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE_DATE = true
You don't actually need the last 2 lines either, as these are the defaults. And MAX_TIMESTAMP_LOOKAHEAD is just for efficiency.
Below is the output.. Last 3 lines should be part of Event2..
Event 1
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event 2
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
Event 3
;ZZZZ
Event 4
;ZZZY
Thank you but no luck.. :(.. Any more suggestions??