Splunk Search

Wrong event time in multiple lines events

ndkhoiits
Explorer

I have a log file which contains a log like following:

2014-02-14 01:49:22,938 Updated this customer:
email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.

once I search in splunk test@test.com I have this result

2012-03-11 02:11:34 email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.

Splunk considers time in the log as event time, it should returns full event (include 2 lines as my example) instead of.

How can I config splunk to fix this problem, event time always is at the first line

Tags (3)
0 Karma

MuS
Legend

Hi ndkhoiits,

you hit two problems, one is the linebreaking which happens at the wrong place and the wrong timestamp is being used in your events.

The linebreaking can be configured, see the docs for more details and examples - take a closer look at the BREAK_ONLY_BEFORE option.
If your events have the wrong time stamp, then you can configure Splunk to use the correct one by using props.conf, see the docs for more details and examples.

hope this helps ...

cheers, MuS

MuS
Legend

based on your provided example, something like this should work:

BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}\s

BREAK_ONLY_BEFORE_DATE tells Splunk not to tread each line containing a time stamp as single event and BREAK_ONLY_BEFORE tells Splunk only to break before the real time stamp....

0 Karma

ndkhoiits
Explorer

Would you like to explain me more detail about how to configure the props.conf

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...