Timestamp containing newline

[las]

Hi.

I have just been presented with a very curious timestamp format.

18-08-2020 
15:41:00,07 
No running service instances found
0 service instances are online, which is different from the expected count of 1.
18-08-2020 
15:46:00,13 
No running service instances found
0 service instances are online, which is different from the expected count of 1.

My first instinct is to create a timeformat = %d-%m%Y\n%H:%M:%S,%2N, but is it at all possible to mix regex with strptime() formats?

Has anybody encountered something like it, and what solution did you come up with.

[thambisetty]

is that single event?

what is your SHOULD_LINEMERGE for this sourcetype?

[las · Accepted solution]

Sorry, that is two events. Splunk by the timestamp containing the newline.

SHOULD_LINEMERGE = true

Just after I posted this I got thinking, and startet playing with LINE_BREAKER=([\r\n]+)\d{2}-\d{2}, that seems to be able to do the trick