Getting Data In

help with props.conf

vrmandadi
Builder

I have the following raw data and I am trying to break the individual events starting with timestamp and before another timestamp starts .

2020-03-27 00:00:00.003 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): Starting model computation2020-03-27 00:00:00.033 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): # data set ids: 9 / # events: 02020-03-27 00:00:00.050 [quartzJobExecutor-1] INFO c.c.d.c.s.StatisticSchedulerJob - StatisticScheduler saving <21> statistics for statistic 2020-03-27 00:00:00.050 [pool-9-thread-1] INFO c.c.d.core.statistic.StatisticBuffer - Persisting <21> statistics

Thanks in Advance

0 Karma
1 Solution

vrmandadi
Builder

Yes I checked everthing .

This worked for me.

[sourcetype]
SHOULD_LINEMERGE= false
LINE_BREAKER= ()(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})
NO_BINARY_CHECK= true
MAX_DAYS_AGO= 2

View solution in original post

0 Karma

vrmandadi
Builder

Yes I checked everthing .

This worked for me.

[sourcetype]
SHOULD_LINEMERGE= false
LINE_BREAKER= ()(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})
NO_BINARY_CHECK= true
MAX_DAYS_AGO= 2

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Glad you have it working. Do use TIME_FORMAT, however.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these settings for starters:

[mysourcetype]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]]+)
TRUNCATE = 10000
---
If this reply helps you, an upvote would be appreciated.
0 Karma

vrmandadi
Builder

Hello @richgalloway I tried this but it did not work . I am looking to break the events like below from the sample event

2020-03-27 00:00:00.003 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): Starting model computation

2020-03-27 00:00:00.033 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): # data set ids: 9 / # events: 0

2020-03-27 00:00:00.050 [quartzJobExecutor-1] INFO c.c.d.c.s.StatisticSchedulerJob - StatisticScheduler saving statistics for statistic

2020-03-27 00:00:00.050 [pool-9-thread-1] INFO c.c.d.core.statistic.StatisticBuffer - Persisting statistics

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What part is not working? What are you getting?
Did you restart Splunk after changing props.conf?
Did you put the props.conf file in the right place (indexer or HF)?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on