Getting Data In

Timestamp on one event determines subsequent line events in RMAN backup

Path Finder

I want to index log events from RMAN backup log. This log has a log event per line but each line may not have a timestamp. It looks like the example below:

Line event entry 1 at <TIMESTAMP1>
Line event entry 2
Line event entry 3
Line event entry 4 at <TIMESTAMP2>
Line event entry 5

How do I use the first read timestamp to be the timestamp for each subsequent event until a new timestamp is read?

Using the example above, TIMESTAMP1 would be the timestamp for Line event entries 1 thru 3 while TIMESTAMP2 would be the timestamp for Line event entries 4 & 5.

I think is the best way to handle the Oracle RMAN backup log unless someone has done better/differently before.

Tags (2)
0 Karma

Path Finder

After testing this sample log file in Splunk, I found out Splunk already does that automatically.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...