Hi All,
I am having trouble breaking up the log file below:
Each log entry starts with id:#################### and ends with id:@@@@@@@@@@@@@@@@
However as you can see below the logs can be written to by to different processes at the same time, is there any way to have the logs broken as follows:
Start an event with id:#################### and end only when you see the corresponding id ending e.g id:@@@@@@@@@@@@@@@@
Also the log entries also have a start and a complete date, as Splunk by default breaks by date if we swtich this off is there a way to force Splunk to just take the start date as the event date?
The start date proceeds the line id:####################
8656: ################################################
8656: From xxxxxx@xxxxxxxxx 31 Mar 2010 11:33:24 (pid=2768,TSRW.52.2,ditTradeBookManager)
8656: IN ### PagefileUsage: 46,508 K, PeakPagefileUsage: 52,756 K
8656: Fetch Trades For FIRM
8656: This user is GLOBAL hence executing the current Tradeserver Functionality
8656: with condition [BOOK in ('JXH1', 'JXF1') and FIRMfutures.EXPIRY_MONTH >= '01-Mar-2010' and CONTRACT in ('USFF/CBOT', 'AUIBCR/SFE') and FIRMfutures.STATUS = 'WHATIF']
8656: TStradeDB::retrieveTrades returned 0 trades
10152:
10152: ################################################
8656: OUT ### PagefileUsage: 46,508 K, diff : 0 Bytes
10152: From xxxxxx@vxxxxxxxx 31 Mar 2010 11:33:24 (pid=3636,TSRW.52.2,ditTradeBookManager)
8656: OUT ### PeakPagefileUsage: 52,756 K, diff : 0 Bytes
10152: IN ### PagefileUsage: 46,508 K, PeakPagefileUsage: 52,756 K
10152: Fetch Trades For JSW
8656: Completed 31 Mar 2010 11:33:24 (0.031000s elapsed)
8656: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
10152: This user is GLOBAL hence executing the current Tradeserver Functionality
10152: with condition [BOOK in ('JXH1', 'JXF1') and TDtrade.EXPIRY >= '01-Mar-2010' and TDtrade.STATUS = 'WHATIF' and TDtrade.VERSION_DATE = '01-Mar-2010' and CONTRACT in ('NZBL/NZFE', 'AUBL/SFE') and FIRMfutures.STATUS = 'WHATIF']
8656: TStradeDB::retrieveTrades returned 0 trades
8656: OUT ### PagefileUsage: 46,508 K, diff : -68 K
8656: OUT ### PeakPagefileUsage: 52,756 K, diff : 0 Bytes
8656: Completed 31 Mar 2010 11:33:24 (0.032000s elapsed)
8656: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
So from the above I would get the following extracts:
8656: ################################################
8656: From xxxxxx@xxxxxxxx31 Mar 2010 11:33:24 (pid=2768,TSRW.52.2,ditTradeBookManager)
8656: IN ### PagefileUsage: 46,508 K, PeakPagefileUsage: 52,756 K
8656: Fetch Trades For FIRM
8656: This user is GLOBAL hence executing the current Tradeserver Functionality
8656: with condition [BOOK in ('JXH1', 'JXF1') and FIRMfutures.EXPIRY_MONTH >= '01-Mar-2010' and CONTRACT in ('USFF/CBOT', 'AUIBCR/SFE') and FIRMfutures.STATUS = 'WHATIF']
8656: TStradeDB::retrieveTrades returned 0 trades
8656: OUT ### PagefileUsage: 46,508 K, diff : 0 Bytes
8656: OUT ### PeakPagefileUsage: 52,756 K, diff : 0 Bytes
8656: Completed 31 Mar 2010 11:33:24 (0.031000s elapsed)
8656: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
AND
10152: ################################################
10152: From xxxxxxx@xxxxxxxx 31 Mar 2010 11:33:24 (pid=3636,TSRW.52.2,ditTradeBookManager)
10152: IN ### PagefileUsage: 46,508 K, PeakPagefileUsage: 52,756 K
10152: Fetch Trades For JSW
10152: This user is GLOBAL hence executing the current Tradeserver Functionality
10152: TStradeDB::retrieveTrades returned 0 trades
10152: OUT ### PagefileUsage: 46,508 K, diff : 0 Bytes
10152: OUT ### PeakPagefileUsage: 52,756 K, diff : 0 Bytes
10152: Completed 31 Mar 2010 11:33:24 (0.000000s elapsed)
10152: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
AND
8656: ################################################
8656: From xxxxxxx@xxxxxxxxx 31 Mar 2010 11:33:24 (pid=2768,TSRW.52.2,ditTradeBookManager)
8656: IN ### PagefileUsage: 46,576 K, PeakPagefileUsage: 52,756 K
8656: Fetch Trades For FIRM
8656: This user is GLOBAL hence executing the current Tradeserver Functionality
8656: with condition [BOOK in ('JXH1', 'JXF1') and FIRMfutures.EXPIRY_MONTH >= '01-Mar-2010' and CONTRACT in ('NZBL/NZFE', 'AUBL/SFE') and FIRMfutures.STATUS = 'WHATIF']
8656: TStradeDB::retrieveTrades returned 0 trades
8656: OUT ### PagefileUsage: 46,508 K, diff : -68 K
8656: OUT ### PeakPagefileUsage: 52,756 K, diff : 0 Bytes
8656: Completed 31 Mar 2010 11:33:24 (0.032000s elapsed)
8656: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
... View more