I am trying to split the following log into two events based on the line feed in between the events:
15-May-2014 11:49:12.563 (2ba825c174c0) LV3THandlerUtil::transactionHandlerDispatch: Handle Message Start ==>
15-May-2014 11:49:12.564 (2ba825c174c0) LV3THandlerUtil::transactionHandlerDispatch: Call Sequence:[Scheduled
* 0x683a2e0514bc426aa3d85a3a4c27b76a->TCAutoStageEquipment[05/15/14 11:49:09:EquipId: [W29M6P5400] Workstation:[630PRB_NAND
15-May-2014 11:49:12.565 (2ba825c174c0) LV4TCAutoStageEquipment::LotList: Entering...
15-May-2014 11:49:12.566 (2ba825c174c0) LV3Timer::Cancel: Canceled Timer Request for TIMER_malamhstes
15-May-2014 11:49:12.570 (2ba825c174c0) LV3TCAutoStageEquipment::LotList: W29M6P5400: No lots to stage
15-May-2014 11:49:12.571 (2ba825c174c0) LV3TCMIPCHandler::LogBusinessEvent: BECode:[ASAE21], BEShortDesc:[NothingToStage], BEText:[W29M6P5400: Nothing to stage - 0 lot lists in dispatch list]
15-May-2014 11:49:12.576 (2ba825c174c0) LV4TCAutoStageEquipment::LotList: Exiting...
0x019ffbf889e849a0b87f7dc25d396464->TCAutoStageEquipment[05/15/14 11:49:09:EquipId: [RMAC6M3700] Workstation:[630RDA_MACRO] ScheduleMethod:[RTD] StageToTheMax:[-empty-] FailedLots:[{}] StagedLots:[{}] BadRecipes:[{}] ClaimResource:[-empty-] State:[Running] ExpectedMessages:[{LotList,LotListTimeout}]]
15-May-2014 11:49:12.588 (2ba825c174c0) LV3
15-May-2014 11:49:12.589 (2ba825c174c0) LV3
I tried the following in my props.conf and it does not work:
[source::.../trace/AMHSAutoStageSrv/.../AutoStageSrv-TransactionTrace*.trc]
sourcetype = autostagesrv_transactiontrace
TRUNCATE = 0
BREAK_ONLY_BEFORE_DATE = False
LINE_BREAKER = ^\n
MAX_EVENTS = 500
Any ideas?
Can you give this a shot?
In your props.conf
BREAK_ONLY_BEFORE=Handle\sMessage\sStart
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
using those settings it parses the message as such:
* 0x261fce339fb44db2be02f10f4228ab29->TCQualStartRun[05/15/14 17:32:36:State:[Running] ExpectedMessages:[{QualStartRun}]]
15-May-2014 17:32:36.431 (2ab9fefe44c0) LV4TCQualStartRun::QualStartRun: Entering...
15-May-2014 17:32:36.441 (2ab9fefe44c0) LV4TCQualStartRun::QualStartRun: Exiting...
Are the asterisks in the log message causing issues with splunk?