Hi, thanks very much for this app. Can you confirm if this event from a Nexus 7K be sourcetyped to cisco:ios? May 27 15:08:26 mydevice.mydomain.com : 2016 May 27 20:18:35.777 UTC: May 27 20:18:35 %KERN-6-SYSTEM_MSG: [36173794.518668] sd 1:0:0:0: [sdc] ASC=0x0 ASCQ=0x0 - kernel ... View more

Hi, Relative newbie here. I have a host that is splitting large messages into multiple syslog messages. The beginning of the message contains two timestamps, but the trailing messages only contain one. The messages arrive like this: May 5 08:12:16 myhost.company.com 05/05/16 08:12:16.392 [part1] May 5 08:12:16 myhost.company.com [part2] May 5 08:12:16 myhost.company.com [part3] Miraculously, I somehow managed to get the messages combined into a single by editing the props.conf: NO_BINARY_CHECK = true MAX_EVENTS=50000 SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD = 25 TIME_PREFIX = ^ TRUNCATE = 0 LINE_BREAKER = ([\r\n]+)\w+\s+\d+\s+\d+:\d+:\d+\s+\w+\.\w+\.\w+\.\w+\s\d+\/\d+\/\d+\s+\d+:\d+:\d+\.\d+ And this seems to work fine, but what I noticed is that the timestamps from the two trailing messages are also included in the combined event, kind of like this: May 5 08:12:16 myhost.company.com 05/05/16 08:12:16.392 [part1]May 5 08:12:16 myhost.company.com [part2]May 5 08:12:16 myhost.company.com [part3] Is there a way to break the events based on the second timestamp in the first message, but strip out the timestamps from the following two messages? ... View more

I'm getting "DateParserVerbose - Failed to parse timestamp" from a syslog source. I'm a pretty inexperienced Splunk user, but the TIME_FORMAT value is %b %d %H:%M:%S , which looks right to me??? I want to parse the timestamp at the beginning of the message. Here's a sample message: Apr 21 15:38:31 10.144.15.220 device01: *osapiBsnTimer: Apr 21 15:38:31.784: #NFA_V9-3-FAIL_SEND_MSG: [PS] nfa_timer.c:67 The system has failed to Send Msg to the NetFlow Task - One Second Timer Message could not be sent. Return Code (1) Here's the warning: 04-21-2016 15:38:31.587 +0200 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Thu Apr 21 15:38:31 2016). Context: source::udp:3514|host::10.144.15.220|syslog| And here's the sourcetype definition: [syslog] ANNOTATE_PUNCT = True AUTO_KV_JSON = true BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = True CHARSET = UTF-8 DATETIME_CONFIG = HEADER_MODE = LEARN_SOURCETYPE = true LINE_BREAKER_LOOKBEHIND = 100 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 256 MAX_TIMESTAMP_LOOKAHEAD = 32 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = NO_BINARY_CHECK = true REPORT-syslog = syslog-extractions SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard SHOULD_LINEMERGE = False TIME_FORMAT = %b %d %H:%M:%S TIME_PREFIX = ^ TRANSFORMS = syslog-host TRUNCATE = 10000 category = Operating System description = Output produced by many syslog daemons, as described in RFC3164 by the IETF detect_trailing_nulls = false disabled = false maxDist = 3 priority = pulldown_type = true sourcetype = ... View more