We found the following message in the data and Splunk recognizes it as a timestamp. How can I prevent this interpretation and add it to the event before it?
parameters: :I1:=1109002298;
thx
Never, ever let splunk guess time details. Use these props.conf settings:
[YourSourcetypeHere]
TIME_PREFIX =
TIME_FORMAT =
MAX_TIMESTAMP_LOOKAHEAD =
We found a solution for us:
[your_sourcetype]
BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
DATETIME_CONFIG =
LINE_BREAKER = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
Your best bet is to configure a specific timestamp lookahead/format and event break options.
To give you a bit more help are you able to share a few complete events?
We try "TIME_FORMAT", but:
The logfile has a second eventtype included (unordered mix 😞 😞
********** first log of session at 2018-12-14 09:31:42,793
message
*********
In this case only the timestamp upstairs is found, not the second time (*** first log of...) format.
If we not use the "TIME_FORMAT", splunk regognize both timeformats and the unwanted value.
In that case 🙂
Use this:
MAX_TIMESTAMP_LOOKAHEAD = 24
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%L
This is the full event:
2018-12-14 09:01:42,793
statement:
SELECT t0.id,t0.name1 FROM DUMMY t0, DUMMY2 t1
WHERE (t0.id = :I1) AND (t1.id = t0.id
)
parameters: :I1:=1109002298;
CPL Stacktrace - Start ...
CPL Stacktrace - End
2018-12-14 09:01:43,793
NEW EVENT
In props.conf add the following to the stanza for your sourcetype.
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%L