Getting Data In

Timestamp on one event determines subsequent line events in RMAN backup

rasingh
Path Finder

I want to index log events from RMAN backup log. This log has a log event per line but each line may not have a timestamp. It looks like the example below:

Line event entry 1 at <TIMESTAMP1>
Line event entry 2
Line event entry 3
Line event entry 4 at <TIMESTAMP2>
Line event entry 5

How do I use the first read timestamp to be the timestamp for each subsequent event until a new timestamp is read?

Using the example above, TIMESTAMP1 would be the timestamp for Line event entries 1 thru 3 while TIMESTAMP2 would be the timestamp for Line event entries 4 & 5.

I think is the best way to handle the Oracle RMAN backup log unless someone has done better/differently before.

Tags (2)
0 Karma

rasingh
Path Finder

After testing this sample log file in Splunk, I found out Splunk already does that automatically.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...