Getting Data In

multi-timestamps/multi-line help

a212830
Champion

Hi,

I have a multi-line feed with two diffferent timestamp formats? How would I handle that? The formats are very similiar, but one starts with an @. I was thinking a regex for the TIME_PREFIX and setting BREAK_ONLY_BEFORE_DATE = true. I need help with the regex for the TIME_PREFIX though...

16:20:33.619 Trc 04541 RequestQueryLocation received from 29
message RequestQueryLocation
AttributeReferenceID 193380
AttributeLocation 'MMK_SIPS_Branch'
AttributeLocationInfoType 0
@16:20:33.6196 [ISCC] Message EventLocationInfo [Event (To Client):00033fd7] is enqueued
@16:20:33.6387 [ISCC] Message EventLocationInfo [Event (To Client):00033fd7] is dequeued
@16:20:33.6387 [0] 8.1.101.01 send_to_client: message EventLocationInfo
AttributeEventSequenceNumber 00000000000347bd
AttributeTimeinuSecs 638707
AttributeTimeinSecs 1391203233 (16:20:33)
AttributeExtensions [439] 00 01 03 00..
'LQ-location-0'(list) 'LQ-location-name' 'MMK_SIPS_CC'
'LQ-location-status' 1
'LQ-link-status' 1
'LQ-capability-mask' bin: ff ff ff fe.. (len=64)
'LQ-extended-capabilities' '(2=(56=396273),8=(16=7),10=(16=15),11=(16=25),14=(73=1),34=(67=3),36=(60=131),75=(16=1),76=(16=25),108=(74=2),113=(83=132604),160=(146=1),161=(146=1),162=(146=1))'
'LQ-version' '8.1.101.01'
'LQ-tscp-version' '8.1.010.46'
AttributeReferenceID 193380
AttributeLocationInfoType 0
16:20:33.638 Trc 04542 EventLocationInfo sent to 29

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

[yoursourcetype]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%H:%M:%S.%3Q
TIME_PREFIX=[@]*
0 Karma

somesoni2
SplunkTrust
SplunkTrust

try with TIME_PREFIX = (@)*

0 Karma

a212830
Champion

I would need multiple timestamps: the ones that have the @ and the ones without are both valid.

0 Karma

theouhuios
Motivator

Are you trying to use the first time after @ as the timestamp?

0 Karma

a212830
Champion

That didn't work.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...