I want to index log events from RMAN backup log. This log has a log event per line but each line may not have a timestamp. It looks like the example below:
Line event entry 1 at <TIMESTAMP1>
Line event entry 2
Line event entry 3
Line event entry 4 at <TIMESTAMP2>
Line event entry 5
How do I use the first read timestamp to be the timestamp for each subsequent event until a new timestamp is read?
Using the example above, TIMESTAMP1 would be the timestamp for Line event entries 1 thru 3 while TIMESTAMP2 would be the timestamp for Line event entries 4 & 5.
I think is the best way to handle the Oracle RMAN backup log unless someone has done better/differently before.
After testing this sample log file in Splunk, I found out Splunk already does that automatically.