props.conf event breaks

[aaronkorn]

Hello,

We have the following format of a log starting with the first message in the log as Status_AdvCorrServerSerial = 0 then the last line of the event as RawCaptureTimeStamp = #, which we set at the timestamp. After the event in the format below there are 2 spaces between each event then it goes into the same format again.

Status_AdvCorrServerSerial = 0
50 Some lines of material...
RawCaptureTimeStamp = 1373987459
-new line-
-new line-
Status_AdvCorrServerSerial = 0
50 Some lines of material...
RawCaptureTimeStamp = 1373987459

Here is our props.conf but it does not seem to properly break on all events:

[ncpmonitor]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial =
TIME_PREFIX=RawCaptureTimeStamp =

Is there something additional I should add to account for the 2 spaces between events or does this props.conf entry look alright?

Thanks!

[lguinn2]

I would probably change the regexes a bit so that they are more flexible regarding the spacing:

[ncpmonitor]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial\s*=
TIME_PREFIX=RawCaptureTimeStamp\s*=\s*

Where exactly are the "spaces"? Are you talking about 2 blank lines between events or two spaces that sometimes appear at the beginning of the line with Status_AdvCorrServerSerial? Splunk should only break events at a line break when you are using BREAK_ONLY_BEFORE - it should break at the beginning of the line that matches.

[lguinn2]

You could also try

BREAK_ONLY_BEFORE=\s*Status_AdvCorrServerSerial\s*

It shouldn't make a difference, though.

[sdaniels]

Beat me to it. One other thing is you may need to specify TIME_FORMAT=%s for the epoch time stamp recognition.

[aaronkorn]

Thanks for your post. The two spaces are between events. Ill give this a shot