Getting Data In
Highlighted

events are accumulate and not splitting after each event end

New Member

{"@timestamp":"2020-04-01T16:51:01.921Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.4.2",(deleted actvally event)"}
{"@timestamp":"2020-04-01T16:51:01.921Z","@metadata":(deleted actvally event) "}}
{"@timestamp":"2020-04-01T16:51:01.921Z","@metadata"(deleted actvally event)}}

Did tried multiple props:

SHOULD_LINEMERGE=false
TIME_FORMAT=%b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=15
BREAK_ONLY_BEFORE_DATE=false

#SHOULD_LINEMERGE=true
#BREAK_ONLY_BEFORE = \w+\s\d+\s\d{2}:\d{2}:\d{2}\s[^\d]
#BREAK_ONLY_BEFORE_DATE=true
#TIME_FORMAT = %b %d %H:%M:%S
#TRUNCATE = 50000
#MAX_EVENTS = 200

#SHOULD_LINEMERGE = false
#LINE_BREAKER = ([\r\n]+)(?=\s*\{\s*\"timestam_ns\")
#TIME_FORMAT = %s%9N
#TIME_PREFIX = ^\s*\{\s*\"timestam_ns\"
#MAX_TIMESTAMP_LOOKAHEAD = 20

#SHOULD_LINEMERGE=false
#INDEXED_EXTRACTIONS=json
###DATETIME_CONFIG = current
###MUST_BREAK_AFTER = ^\w+\s+\w+
##LINE_BREAKER=((?
0 Karma
Highlighted

Re: events are accumulate and not splitting after each event end

Ultra Champion
| makeresults 
| eval _raw="{\"@timestamp\":\"2020-04-01T16:51:01.921Z\",\"@metadata\":{\"beat\":\"filebeat\",\"type\":\"_doc\",\"version\":\"7.4.2\",(deleted actvally event)\"}
{\"@timestamp\":\"2020-04-01T16:51:01.921Z\",\"@metadata\":(deleted actvally event)\"}}
{\"@timestamp\":\"2020-04-01T16:51:01.921Z\",\"@metadata\"(deleted actvally event)\"}}" 
| rex mode=sed "s/(?ms)({\"@time)/#\1/g" 
| makemv delim="#" _raw 
| stats count by _raw 
| rex  "\"(?<timestamp>\d\S+Z)\"," 
| eval _time = strptime(replace(timestamp,"Z","+0000"), "%FT%T.%3Q%z")

I check your log by this query.

props.conf

SHOULD_LINEMERGE = false
LINE_BREAKER = (.){\"@time
TIME_PREFIX = timestamp\":\"
TIME_FORMAT=%FT%T.%3QZ
TZ = UTC

please add fields extraction(TRANSFORMS,REPORT....)
and see
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

View solution in original post

0 Karma
Highlighted

Re: events are accumulate and not splitting after each event end

New Member

Hello,

Thank you so much for getting back.

[source::firehose:aisin:infra:windns]
SHOULDLINEMERGE=false
LINE
BREAKER=(.){\"@time
TIMEPREFIX=timestamp\":\"
TIME
FORMAT = %b %d %H:%M:%S

TIME_FORMAT=%FT%T.%3QZ

TZ=America/New_York

i did keep this and still not working, you mention add fields extraction in transforms, what should i add.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.