time prefix match only part of the events

[sarit_s]

hello,
i have this configuration in my props.conf file:
[f170_system]
BREAK_ONLY_BEFORE = ^\w\s\d+\s\d{2}:\d{2}:\d{2}
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 30
category = Custom
pulldown_type = true

and i have events from two types:

Nov 11 21:43:17 : Info:copyconfig

Sep 20 23:29:54 manager: 

for those who has ":" after timestamp the timestamp is incorrect so for example, splunk shows 6.2.2019 while in the event is 11.11.18

for those who has "manager:" after timestamp everything is ok.

any idea why ?

[nickhills · Accepted solution]

Looks ok to me, but you could try reducing the Timestamp lookahead to 15
I'd also # out or remove the DATETIME_CONFIG line
Is there any reason why you are using BREAK_ONLY_BEFORE as opposed to LINE_BREAKER?

[sarit_s]

fixed ! thanks ! can you add it as an answer so i will be able to approve 🙂
maybe you can explain to me why the DATETIME_CONFIG made this problem ? or maybe it is the Timestamp lookahead ?
looks like im missing something very basic

[nickhills]

Date_config has 3 potential values, "NONE", "CURRENT" or "/etc/datetime.xml" (or another config file)
The default is /etc/datetime.xml, so i wonder if leaving it as 'DATETIME_CONFIG=' was confusing things.

The lookahead specifies how many characters after the prefix the date exists in - "Sep 20 23:29:54" is exactly 15 characters, so setting this specifically forces Splunk to look only in those 15 characters for the time.

[sarit_s]

thanks !