Getting Data In

help with props.conf

vrmandadi
Builder

I have the following raw data and I am trying to break the individual events starting with timestamp and before another timestamp starts .

2020-03-27 00:00:00.003 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): Starting model computation2020-03-27 00:00:00.033 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): # data set ids: 9 / # events: 02020-03-27 00:00:00.050 [quartzJobExecutor-1] INFO c.c.d.c.s.StatisticSchedulerJob - StatisticScheduler saving <21> statistics for statistic 2020-03-27 00:00:00.050 [pool-9-thread-1] INFO c.c.d.core.statistic.StatisticBuffer - Persisting <21> statistics

Thanks in Advance

0 Karma
1 Solution

vrmandadi
Builder

Yes I checked everthing .

This worked for me.

[sourcetype]
SHOULD_LINEMERGE= false
LINE_BREAKER= ()(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})
NO_BINARY_CHECK= true
MAX_DAYS_AGO= 2

View solution in original post

0 Karma

vrmandadi
Builder

Yes I checked everthing .

This worked for me.

[sourcetype]
SHOULD_LINEMERGE= false
LINE_BREAKER= ()(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})
NO_BINARY_CHECK= true
MAX_DAYS_AGO= 2

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Glad you have it working. Do use TIME_FORMAT, however.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these settings for starters:

[mysourcetype]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]]+)
TRUNCATE = 10000
---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

Hello @richgalloway I tried this but it did not work . I am looking to break the events like below from the sample event

2020-03-27 00:00:00.003 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): Starting model computation

2020-03-27 00:00:00.033 [quartzJobExecutor-1] INFO c.c.c.r.c.s.r.i.BusinessAssetsForDataSetRecommenderDelegate - (dataset, asset): # data set ids: 9 / # events: 0

2020-03-27 00:00:00.050 [quartzJobExecutor-1] INFO c.c.d.c.s.StatisticSchedulerJob - StatisticScheduler saving statistics for statistic

2020-03-27 00:00:00.050 [pool-9-thread-1] INFO c.c.d.core.statistic.StatisticBuffer - Persisting statistics

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What part is not working? What are you getting?
Did you restart Splunk after changing props.conf?
Did you put the props.conf file in the right place (indexer or HF)?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...