multi-timestamps/multi-line help

[a212830]

Hi,

I have a multi-line feed with two diffferent timestamp formats? How would I handle that? The formats are very similiar, but one starts with an @. I was thinking a regex for the TIME_PREFIX and setting BREAK_ONLY_BEFORE_DATE = true. I need help with the regex for the TIME_PREFIX though...

16:20:33.619 Trc 04541 RequestQueryLocation received from 29
message RequestQueryLocation
AttributeReferenceID 193380
AttributeLocation 'MMK_SIPS_Branch'
AttributeLocationInfoType 0
@16:20:33.6196 [ISCC] Message EventLocationInfo [Event (To Client):00033fd7] is enqueued
@16:20:33.6387 [ISCC] Message EventLocationInfo [Event (To Client):00033fd7] is dequeued
@16:20:33.6387 [0] 8.1.101.01 send_to_client: message EventLocationInfo
AttributeEventSequenceNumber 00000000000347bd
AttributeTimeinuSecs 638707
AttributeTimeinSecs 1391203233 (16:20:33)
AttributeExtensions [439] 00 01 03 00..
'LQ-location-0'(list) 'LQ-location-name' 'MMK_SIPS_CC'
'LQ-location-status' 1
'LQ-link-status' 1
'LQ-capability-mask' bin: ff ff ff fe.. (len=64)
'LQ-extended-capabilities' '(2=(56=396273),8=(16=7),10=(16=15),11=(16=25),14=(73=1),34=(67=3),36=(60=131),75=(16=1),76=(16=25),108=(74=2),113=(83=132604),160=(146=1),161=(146=1),162=(146=1))'
'LQ-version' '8.1.101.01'
'LQ-tscp-version' '8.1.010.46'
AttributeReferenceID 193380
AttributeLocationInfoType 0
16:20:33.638 Trc 04542 EventLocationInfo sent to 29

[somesoni2]

Try this

[yoursourcetype]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%H:%M:%S.%3Q
TIME_PREFIX=[@]*

[somesoni2]

try with TIME_PREFIX = (@)*

[a212830]

I would need multiple timestamps: the ones that have the @ and the ones without are both valid.

[theouhuios]

Are you trying to use the first time after @ as the timestamp?

[a212830]

That didn't work.