Wrong event time in multiple lines events

[ndkhoiits]

I have a log file which contains a log like following:

2014-02-14 01:49:22,938 Updated this customer:
email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.

once I search in splunk test@test.com I have this result

2012-03-11 02:11:34 email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.

Splunk considers time in the log as event time, it should returns full event (include 2 lines as my example) instead of.

How can I config splunk to fix this problem, event time always is at the first line

[MuS]

Hi ndkhoiits,

you hit two problems, one is the linebreaking which happens at the wrong place and the wrong timestamp is being used in your events.

The linebreaking can be configured, see the docs for more details and examples - take a closer look at the BREAK_ONLY_BEFORE option.
If your events have the wrong time stamp, then you can configure Splunk to use the correct one by using props.conf, see the docs for more details and examples.

hope this helps ...

cheers, MuS

[MuS]

based on your provided example, something like this should work:

BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}\s

BREAK_ONLY_BEFORE_DATE tells Splunk not to tread each line containing a time stamp as single event and BREAK_ONLY_BEFORE tells Splunk only to break before the real time stamp....

[ndkhoiits]

Would you like to explain me more detail about how to configure the props.conf