Getting Data In

multiline event not working

mfscully
Explorer

I am trying to split the following log into two events based on the line feed in between the events:

15-May-2014 11:49:12.563  (2ba825c174c0) LV3         THandlerUtil::transactionHandlerDispatch: Handle Message Start ==> 
15-May-2014 11:49:12.564 (2ba825c174c0) LV3 THandlerUtil::transactionHandlerDispatch: Call Sequence:[Scheduled
* 0x683a2e0514bc426aa3d85a3a4c27b76a->TCAutoStageEquipment[05/15/14 11:49:09:EquipId: [W29M6P5400] Workstation:[630PRB_NAND
15-May-2014 11:49:12.565 (2ba825c174c0) LV4 TCAutoStageEquipment::LotList: Entering...
15-May-2014 11:49:12.566 (2ba825c174c0) LV3 Timer::Cancel: Canceled Timer Request for TIMER_malamhstes
15-May-2014 11:49:12.570 (2ba825c174c0) LV3 TCAutoStageEquipment::LotList: W29M6P5400: No lots to stage
15-May-2014 11:49:12.571 (2ba825c174c0) LV3 TCMIPCHandler::LogBusinessEvent: BECode:[ASAE21], BEShortDesc:[NothingToStage], BEText:[W29M6P5400: Nothing to stage - 0 lot lists in dispatch list]
15-May-2014 11:49:12.576 (2ba825c174c0) LV4 TCAutoStageEquipment::LotList: Exiting...
0x019ffbf889e849a0b87f7dc25d396464->TCAutoStageEquipment[05/15/14 11:49:09:EquipId: [RMAC6M3700] Workstation:[630RDA_MACRO] ScheduleMethod:[RTD] StageToTheMax:[-empty-] FailedLots:[{}] StagedLots:[{}] BadRecipes:[{}] ClaimResource:[-empty-] State:[Running] ExpectedMessages:[{LotList,LotListTimeout}]]

15-May-2014 11:49:12.588 (2ba825c174c0) LV3 THandlerUtil::transactionHandlerDispatch: Handle Message Start ==>
15-May-2014 11:49:12.589 (2ba825c174c0) LV3 THandlerUtil::transactionHandlerDispatch: Call Sequence:[ScheduledEvent

I tried the following in my props.conf and it does not work:

[source::.../trace/AMHSAutoStageSrv/.../AutoStageSrv-TransactionTrace*.trc]
sourcetype = autostagesrv_transactiontrace
TRUNCATE = 0

SHOULD_LINEMERGE = True

BREAK_ONLY_BEFORE_DATE = False
LINE_BREAKER = ^\n

BREAK_ONLY_BEFORE = Handle\sMessage\sStart

MAX_EVENTS = 500

Any ideas?

0 Karma

somesoni2
Revered Legend

Can you give this a shot?

In your props.conf

BREAK_ONLY_BEFORE=Handle\sMessage\sStart
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
0 Karma

mfscully
Explorer

using those settings it parses the message as such:


* 0x261fce339fb44db2be02f10f4228ab29->TCQualStartRun[05/15/14 17:32:36:State:[Running] ExpectedMessages:[{QualStartRun}]]
15-May-2014 17:32:36.431 (2ab9fefe44c0) LV4 TCQualStartRun::QualStartRun: Entering...
15-May-2014 17:32:36.441 (2ab9fefe44c0) LV4 TCQualStartRun::QualStartRun: Exiting...

Are the asterisks in the log message causing issues with splunk?

0 Karma