Getting Data In

Source Type, Web Application and BREAK_ONLY_BEFORE

jsgossett
Engager

I discovered our logs were split between events. I notice that Splunk split the event ANY date and time it found in our logs. See below.

<ResponseEndTimestamp>11/05/2020 09:53:33</ResponseEndTimestamp> </RCExtResponse> 2020-11-05 08:53:36,916 [http-nio-8080-exec-4] [198.153.9.206||1573FF21ECE6B4E4DA213F08E73230B3|] INFO c.v.c.d.DrFirstGatewayService - Retrived patient object(Patient:...) ....

2020-11-05 08:53:37,110 [http-nio-8080-exec-4] should have started a new event.

To fix, I wanted to defined a BREAK_ONLY_BEFORE in the Source Type. Unfortunately, the Web UI keeps changing values when I save. See before and after.

Before

BeforeBefore

After

AfterAfter

Has anyone encountered this? Any help would be greatly appreciated.

Josh

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's more efficient to use LINE_BREAKER.  Try these props.conf settings.

[STM]
SHOULD_LINEMERGE = false
LINE_BREAKER = \<\/RCExtResponse\>()
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It's more efficient to use LINE_BREAKER.  Try these props.conf settings.

[STM]
SHOULD_LINEMERGE = false
LINE_BREAKER = \<\/RCExtResponse\>()
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
---
If this reply helps you, Karma would be appreciated.

jsgossett
Engager

Rich,

Thank you so much. You were helpful.

In the end, I used the following configuration.

TIME_PREFIX^
TIME_FORMAT%Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD23

 

I excluded the LINE_BREAKER and SHOULD_LINEMERGE settings since we still want to use default value (e.g. (\n\r)+). Also, our events expand multiple lines

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...