I have a log file which contains a log like following:
2014-02-14 01:49:22,938 Updated this customer:
email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.
once I search in splunk test@test.com
I have this result
2012-03-11 02:11:34 email: test@test.com, created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY.
Splunk considers time in the log as event time, it should returns full event (include 2 lines as my example) instead of.
How can I config splunk to fix this problem, event time always is at the first line
Hi ndkhoiits,
you hit two problems, one is the linebreaking
which happens at the wrong place and the wrong timestamp
is being used in your events.
The linebreaking
can be configured, see the docs for more details and examples - take a closer look at the BREAK_ONLY_BEFORE
option.
If your events have the wrong time stamp, then you can configure Splunk to use the correct one by using props.conf
, see the docs for more details and examples.
hope this helps ...
cheers, MuS
based on your provided example, something like this should work:
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}\s
BREAK_ONLY_BEFORE_DATE tells Splunk not to tread each line containing a time stamp as single event and BREAK_ONLY_BEFORE tells Splunk only to break before the real time stamp....
Would you like to explain me more detail about how to configure the props.conf