Source Type, Web Application and BREAK_ONLY_BEFORE

[jsgossett]

I discovered our logs were split between events. I notice that Splunk split the event ANY date and time it found in our logs. See below.

<ResponseEndTimestamp>11/05/2020 09:53:33</ResponseEndTimestamp> </RCExtResponse> 2020-11-05 08:53:36,916 [http-nio-8080-exec-4] [198.153.9.206||1573FF21ECE6B4E4DA213F08E73230B3|] INFO c.v.c.d.DrFirstGatewayService - Retrived patient object(Patient:...) ....

2020-11-05 08:53:37,110 [http-nio-8080-exec-4] should have started a new event.

To fix, I wanted to defined a BREAK_ONLY_BEFORE in the Source Type. Unfortunately, the Web UI keeps changing values when I save. See before and after.

Before

Before

After

After

Has anyone encountered this? Any help would be greatly appreciated.

Josh

[richgalloway · Accepted solution]

It's more efficient to use LINE_BREAKER.  Try these props.conf settings.

[STM]
SHOULD_LINEMERGE = false
LINE_BREAKER = \<\/RCExtResponse\>()
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23

[jsgossett]

Rich,

Thank you so much. You were helpful.

In the end, I used the following configuration.

TIME_PREFIX	^
TIME_FORMAT	%Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD	23

I excluded the LINE_BREAKER and SHOULD_LINEMERGE settings since we still want to use default value (e.g. (\n\r)+). Also, our events expand multiple lines