Splunk Enterprise Security

Line Breake issue

khalidewaidah
Explorer

Could you provide me how it can write line break and Time regex below logs .

2020-09-26 19:27:33,092 DEBUG com.edifecs.shared.rmi.RMISocketFactoryInitializer - Initialize custom rmiSocketFactory...\n2014-09-26 19:27:33,983 DEBUG com.edifecs.shared.events.transport.rmi.RmiEventBusBuilder - Building EventBus instance for parameters: [eventBusID=EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}, rmiConfigurer=com.edifecs.shared.registry.RMIConfigurer@a9255c, remoteEventBusAddresses=[rmi://TEDITM01:1090/EventBus, rmi://TXENGN01:1090/EventBus, rmi://BCKCMD1:1090/EventBus], serverMode=true]\n2014-09-26 19:27:34,155 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Web Component/TEDITM01 {5ba842c9-9310-4342-9362-e63d8a964605}\n2014-09-26 19:27:34,186 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] local bus started up\n2014-09-26 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - Failed to obtain a reference to remote EventBus. Connection to rmi://BCKCMD1:1090/EventBus refused.\n2014-09-26 19:27:35,921 DEBUG com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - java.rmi.ConnectException: Connection refused to host: BCKCMD1; nested exception is: \n java.net.ConnectException: Connection refused: connect\n2014-09-26 19:27:37,655 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Service Manager/TEDITM01 {20f1a2e4-14d7-40e0-85b1-7462173ac1c3}

Labels (1)
0 Karma

michael_bates_1
Path Finder

Hi
It is hard to tell if this should be a single event, or if it is multiple events.

Assuming this is multiple events broken on a \n followed by date, the following should work

props.conf

[ mysourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\n)\d{4}
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...