How do I get the second datetime from the following log ?

[vikas_gopal]

Hi Expert,

I have the below log. In this, I have 2 different time with different formats. I need to set a second date and time at the time of source type selection. I used the below settings, but I am getting the below warning.

Can anyone tell me what is missing here?

Log Sample

[167154] 2018-11-13 00:43:26 Received fatal signal 6 (Aborted).  Cause:   Signal sent by PID 4679 running under UID 1687.  Crashing thread: Main Thread   OS: Linux  Arch: x86-64
 Backtrace:
 Linux / usr13.eng.buttercupgames.com / 2.6.32-279.5.2.el6.x86_64 / #1 SMP Fri Aug 24 01:07:11 UTC 2013 / x86_64

I need to select Fri Aug 24 01:07:11 UTC 2013.

Sourcetype Settings

[ abc ]  
SHOULD_LINEMERGE=true 
NO_BINARY_CHECK=true 
TIME_FORMAT=%a %b %d %H:%M:%S %Z%z %Y 
TIME_PREFIX=SMP\s

With the above settings, things looks good, but I can see one warning in the data preview screen. It says:

Could not use stptime to parse timestamp from "Fri Aug 24 01:07:11 UTC 2013 / x86_64"

[FrankVl · Accepted solution]

I think the issue is with: %Z%z. I think that should be just %Z?

[vikas_gopal]

Well I tried with only %Z ,with this I can see 2 lines as Splunk split the record in 2 one with the first time and second with the mentioned format date basis which is wrong (11/13/18 11:02:23.000 PM and 8/24/13 6:37:11.000 AM). It should be one line only

[FrankVl]

That sounds more like an issue with your linebreaking config than anything else.

Try:

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\[\d+\]

And perhaps see if you can share a screenshot of the results you got with %Z, (and the raw data that was used for that test).

[vikas_gopal]

Wow Line Break logic works like a charm but Can you help me to understand why was that , why we need line break here ?

[FrankVl]

Not entirely sure, as I don't fully understand your description of how it failed. But in general, when you set should_linemerge to true and leave other related settings to default, the way Splunk detects which lines to combine into a single event and where to split between separate events is dependent on where it detects the timestamp. And especially for multiline events, that may not always be how you want it to behave.

In general using an explicit LINE_BREAKER (and setting SHOULD_LINEMERGE to false) is better for performance and to my opinion also makes the whole process more predictable.

You can have a look at the props.conf spec for more details on how those settings interact: http://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf#Line_breaking