Getting Data In

Line breaker to break the events

New Member

Below is the app log content and the configuration parameters in props.conf. Not sure what is going wrong.. Output is all messed up and I dont see the events getting generated seperatly.. Any help??

11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

TRUNCATE=240000
TIMEPREFIX = ^Timestamp:\s
TIME
FORMAT= %m/%d/%Y %H:%M:%S
LINEBREAKER = ([\r\n]+)(?=Timestamp:\s)
SHOULD
LINEMERGE=false

This is what I am expecting on SPLUNK
Event One
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234

Event two

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY

;ZZZZ

;ZZZY

Event three..

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU

11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1

;ZZRZ

;ZZRY

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You won't see Event 3 and Event 4 merged into Event 2 as long as SHOULD_LINEMERGE is set to false, stick to the default value of true.

View solution in original post

0 Karma

New Member

That did the knack.. Thank you soo much..

0 Karma

Legend

You do not need a time prefix or a line breaker. Try

TRUNCATE=240000 
TIME_FORMAT= %m/%d/%Y %H:%M:%S 
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE_DATE = true

You don't actually need the last 2 lines either, as these are the defaults. And MAXTIMESTAMPLOOKAHEAD is just for efficiency.

0 Karma

New Member

Below is the output.. Last 3 lines should be part of Event2..

Event 1
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event 2
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
Event 3
;ZZZZ
Event 4
;ZZZY

0 Karma

New Member

Thank you but no luck.. :(.. Any more suggestions??

0 Karma