Splunk Search

setting up Line Break in props.conf for compiled year month and date

valeriedls01
Loves-to-Learn Everything

I have a log the needs the props.conf setup but the year month and date is complied into one with no spaces or separators.  How can I regex this in the  line breaker or time format 

this is an example of the log start of each event 
20240507 10:47:38.467 [DEBUG] 12672

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try like

LINE_BREAKER = ([\n\r]+)\d{8} \d\d:\d\d:
TIME_FORMAT = %Y%m%d %H:%M%:%S.%3Q
TIME_PREFIX = ^

 r. Ismo

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...