Getting Data In

Time prefix ;

smudge797
Path Finder

I have events that end and start with :

orderLock;null;
2013-11-07 05:55:38.431; Log entry......
162405913;;
2013-11-07 05:55:38.431; Log entry......
;;
2013-11-07 05:55:38.431; Log entry......

I have the time strip as:
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N;
But I want to include the ; at the end of the log entry on the line before the next log entry what regex should I use with the TIME_PREFIX =

0 Karma

ShaneNewman
Motivator
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
TIME_PREFIX = [\r\n]+

Truthfully, these setting should work fine...

0 Karma

smudge797
Path Finder

Yeah Im trying to get the Event to break after the ; which is part of the previous entry.

0 Karma

ShaneNewman
Motivator
TIME_PREFIX = \;[\r\n]+
0 Karma

smudge797
Path Finder

blah blah blah itineraryUnLock;;
2013-11-07 06:00:20.813;baf9f8c8-efa7-4425-982e-a96179f840c6; Lots if text blah blah blah
blah blah blah LockRelease;null;
2013-11-07 06:00:20.851;ad8cd20e-ff45-49ad-8988-c1c2b9f58700; Lots if text blah blah blah
blah blah blah LockRelease;null;
2013-11-07 06:00:20.852;ad8cd21e-ff55-40ad-8990-c2c2b9f58700; Lots if text blah blah blah
blah blah blah ServerAdd;;
2013-11-07 06:00:22.442;6671762e-0a52-4c7b-aee3-69c10b261d99; Lots if text blah blah blah

0 Karma

smudge797
Path Finder

Didnt work, maybe Im not being descriptive enough. I put more log data in.

0 Karma

kristian_kolb
Ultra Champion

It's a bit unclear what you want to do. Do you want the last ; on the line preceding the timestamp to be part of the same message as the timestamp? In that case it has nothing to do with the TIME_PREFIX, but rather with the line-breaking of the event stream.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...