Getting Data In

Timestamp and line not properly break

antonyhan
Path Finder

I have this inputs.conf

[ServerLogs]
SHOULD_LINEMERGE = true
TRUNCATE = 0
BREAK_ONLY_BEFORE = ^\d{6}\s+\d{2}\:\d{2}\:\d{2}\:\d{3}\s+
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT =%m%d%y %H:%M:%S:%3N
BREAK_ONLY_BEFORE_DATE = true

and piece of my log looks like:

        <imagePath>C:\Fiserv\TCAP\bin\..\data\images\20160714222778400413_20160714141254232.img</imagePath>
      </imageObject>
      <itemUserFields />
      <cpcsData />


071216 09:36:03:364 4524/6.4.2.10/2 INFO  CCaptureApiServerApp::InitInstance(): before requestProcessor.DoModal() 

Second piece of log was recognized correctly with property time format. however for the first piece, the line was also broken before, and a time was recognized from "20160714141254232", which I am confused that that's not the time format I defined.

Anyone can shed some light here?

0 Karma
1 Solution

twinspop
Influencer

You've got 2 break definitions. Which is odd. Also, I've had much better luck using LINE_BREAKER vs BREAK_ONLY_BEFORE for some reason.

[ServerLogs]
LINE_BREAKER = ([\r\n]+)\d{6}\s+\d{2}\:\d{2}\:\d{2}\:\d{3}\s+
SHOULD_LINEMERGE = false
TRUNCATE = 0
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT =%m%d%y %H:%M:%S:%3N
TIME_PREFIX = ^

View solution in original post

0 Karma

twinspop
Influencer

You've got 2 break definitions. Which is odd. Also, I've had much better luck using LINE_BREAKER vs BREAK_ONLY_BEFORE for some reason.

[ServerLogs]
LINE_BREAKER = ([\r\n]+)\d{6}\s+\d{2}\:\d{2}\:\d{2}\:\d{3}\s+
SHOULD_LINEMERGE = false
TRUNCATE = 0
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT =%m%d%y %H:%M:%S:%3N
TIME_PREFIX = ^
0 Karma

antonyhan
Path Finder

Thanks twinspop. it turns out a file permission problem on the servers and your setting works.

0 Karma

antonyhan
Path Finder

Tried and didn't work.
So weird....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...