Splunk Search

Wrong event time in multiple lines events

ndkhoiits
Explorer

I have a log file which contains a log like following:

2014-02-14 01:49:22,938 Updated this customer:
email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.

once I search in splunk test@test.com I have this result

2012-03-11 02:11:34 email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.

Splunk considers time in the log as event time, it should returns full event (include 2 lines as my example) instead of.

How can I config splunk to fix this problem, event time always is at the first line

Tags (3)
0 Karma

MuS
Legend

Hi ndkhoiits,

you hit two problems, one is the linebreaking which happens at the wrong place and the wrong timestamp is being used in your events.

The linebreaking can be configured, see the docs for more details and examples - take a closer look at the BREAK_ONLY_BEFORE option.
If your events have the wrong time stamp, then you can configure Splunk to use the correct one by using props.conf, see the docs for more details and examples.

hope this helps ...

cheers, MuS

MuS
Legend

based on your provided example, something like this should work:

BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}\s

BREAK_ONLY_BEFORE_DATE tells Splunk not to tread each line containing a time stamp as single event and BREAK_ONLY_BEFORE tells Splunk only to break before the real time stamp....

0 Karma

ndkhoiits
Explorer

Would you like to explain me more detail about how to configure the props.conf

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...