Field extraction taking whole event as field

[snehal8]

Hello Everyone

I am working with three different files.Each file has different start time and end time.that all files is in one index.

my problem is when i am extracting field that is start time initial its taking only that time but when i came to search app that is table start time then its taking hole lines whichever its come after the starttime

regex for starttime is
(?i) Time : (?P.+)

Another problem that is my each file has more lines in that.so when i come for extracting field as end time is in last line so i am not able to see that in my extraction form.

can any one help me on this.

thank you

[tgow]

I am assuming that each line of your log messages is a separate event in Splunk. This means that Splunk does not know how to break the events and you will have to teach it. Event line breaking happens at index time so you will have to configure this for any new data or purge/reindex the data.

props.conf

[logfile]
LINE_BREAKER = Return\s+Code[^\n]+
EXTRACT-start = ^Start\s+Time\s+:(?<start_time>[^\n]+)
EXTRACT-end = ^End\s+Time:(?<end_time>[^\n]+)

Here are some links to more information:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents

Hope this helps.

[tgow]

It would be very helpful if you could put some examples of your data in the question.

[snehal8]

Sample Example

Script Name : xyz0101.ksh
Start Time : 2012-12-09 16:40:27
Arguments :
Env Variables :

Some lines here

---

PL/SQL procedure successfully completed.
error code is 0
End Time : 2012-12-09 18:47:15
Return Code = 0 (Normal Termination, Continue Processing)

I want to extract start time and end time and error code in single table. I was able to extract StartTime but not Endtime,Return code in regex window