Think I may have tried everything in props at this stage, Splunk does not seem to be paying much attention to anything I change though as the linebreaking was working to a degree and is now questionable. The main issue is the log file is a bit of a mess, it contains various forms of xml and also normal looking events. This is my default that is needed to detect the difference between the day and month (otherwise 07/10 is picked up as 10/07): [messy_log] TIME_FORMAT=%d/%m/%Y %H:%M:%S,%3N TIME_PREFIX=(^\s)|(^.{8}\s) MAX_TIMESTAMP_LOOKAHEAD=35 NO_BINARY_CHECK=true # 07/10/2015 15:21:07,413 INFO # BLAAH771 18/08/2015 14:59:40,052 The default BREAK_ONLY_BEFORE_DATE = True is being applied (confirmed via btools) I have also tried things with the various Break before/don't break before/break after settings: BREAK_ONLY_BEFORE = \s\d\d\/\d\d\/\d\d\d\d\s\d\d\:\d\d\:\d\d\,\d\d\d\s Still not cooperating. In a Splunk search, there are some single lines being broken into single line events, but others that look like this: 09/10/2015 16:49:15,502 INFO host.log - <Request>snipped</Request> <Response>snipped</Response></channel_log_entry> 09/10/2015 16:49:16,343 INFO host.log - <Request>snipped</Request> <Response>snipped</Response></channel_log_entry> 09/10/2015 16:49:16,388 INFO host.log - <Request>snipped</Request> <Response>snipped</Response></channel_log_entry> BLAAH678 09/10/2015 16:49:16,508 INFO host.log - blahblahblahyakkitysmakkity BLEEH876 09/10/2015 17:08:10,445 INFO host.log - user has logged off Above is a single event seen in Splunk, 5 separate events being caught as one. The xml request and responses are on different lines which may be complicating things further and possibly the space between the start of the event and the timestamp in some events. To make it more interesting, if I try and put the data through the data preview/sourcetype builder in "Data Inputs" with the same settings as the above props, everything is picked up perfectly. ... View more

Hi all, I'm using props and transforms to extract fields, all the fields are extracted properly, except the first one. This is mainly because my transforms is currently: [extract_fields] DELIMS = "," FIELDS = "field1", "field2", "field3", etc The first line of the event itself is as follows: Dec 2 15:47:55 foo.bar.ie IRL:"field1","field2","field3" So it extracts Dec 2 15:47:55 foo.bar.ie IRL:"field1" as the first field. How would I go about ignoring that first part, so the field extraction starts after IRL:? I was looking for some kind of field extraction parameter similar to TIME_PREFIX but for field extractions, but there doesn't seem to be one or I'm just not understanding the docs correctly. ... View more