Getting Data In

Source Type, Web Application and BREAK_ONLY_BEFORE

jsgossett
Engager

I discovered our logs were split between events. I notice that Splunk split the event ANY date and time it found in our logs. See below.

<ResponseEndTimestamp>11/05/2020 09:53:33</ResponseEndTimestamp> </RCExtResponse> 2020-11-05 08:53:36,916 [http-nio-8080-exec-4] [198.153.9.206||1573FF21ECE6B4E4DA213F08E73230B3|] INFO c.v.c.d.DrFirstGatewayService - Retrived patient object(Patient:...) ....

2020-11-05 08:53:37,110 [http-nio-8080-exec-4] should have started a new event.

To fix, I wanted to defined a BREAK_ONLY_BEFORE in the Source Type. Unfortunately, the Web UI keeps changing values when I save. See before and after.

Before

BeforeBefore

After

AfterAfter

Has anyone encountered this? Any help would be greatly appreciated.

Josh

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's more efficient to use LINE_BREAKER.  Try these props.conf settings.

[STM]
SHOULD_LINEMERGE = false
LINE_BREAKER = \<\/RCExtResponse\>()
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It's more efficient to use LINE_BREAKER.  Try these props.conf settings.

[STM]
SHOULD_LINEMERGE = false
LINE_BREAKER = \<\/RCExtResponse\>()
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
---
If this reply helps you, Karma would be appreciated.

jsgossett
Engager

Rich,

Thank you so much. You were helpful.

In the end, I used the following configuration.

TIME_PREFIX^
TIME_FORMAT%Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD23

 

I excluded the LINE_BREAKER and SHOULD_LINEMERGE settings since we still want to use default value (e.g. (\n\r)+). Also, our events expand multiple lines

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...