I'm having a heck of a time figuring out the best way to get splunk to show these multiline events in one event. Any help would be appreciated.
Each event is broken up by the line that looks like this:
2011-03-22 18:43:58 -04:00 info critical_en8.web: 22 Mar 2011 18:43:58,906 [ERROR] [crm] [Misc] misc
OR
2011-03-22 18:44:00 -04:00 info critical_en8.web: 22 Mar 2011 18:44:00,061 [ERROR] [crm] [Misc] misc
Example log:
2011-03-22 18:43:58 -04:00 info critical_en8.web: 22 Mar 2011 18:43:58,906 [ERROR] [crm] [Misc] misc
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] javax.servlet.ServletException:
com.infusion.util.db.LoadingException: Couldn't find the record with primary key 0 in Contact
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:862)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:791)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jsp.Contact.tab.address_jsp._jspService(address_jsp.java:130)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:377)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] Caused by: com.infusion.util.db.LoadingException: Couldn't find the record with primary key 0 in Contact
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at com.infusion.crm.db.DatabaseObject.loadFromDatabase(DatabaseObject.java:1700)
2011-03-22 18:43:58 -04:00 info critical_en8.web: [ERROR] [crm] at com.infusion.crm.db.DatabaseObject.loadFromDatabase(DatabaseObject.java:1675)
2011-03-22 18:44:00 -04:00 info critical_en8.web: 22 Mar 2011 18:44:00,061 [ERROR] [crm] [Misc] misc
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] javax.servlet.ServletException: com.infusion.util.db.LoadingException: No primary key defined to load Contact
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:862)
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:791)
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jsp.Contact.tab.filebox_jsp._jspService(filebox_jsp.java:281)
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:377)
2011-03-22 18:44:00 -04:00 info critical_en8.web: [ERROR] [crm] at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
... View more