Getting Data In

How to correctly configure timestamp extraction?

hans
Splunk Employee
Splunk Employee

Here is a sample log:

2010-05-06 16:41:18,082 INFO SplunkCLI :: Executing: "/Users/hs/bin/"  status space  

    Thu May  6 16:40:42 2010                    1              unknown  /var/folders/0g/0g2PnEjcEOeS9P-W4W4aIQkTMTmp9142.txt
---------------------------------------
Collapse files into common directories?
---------------------------------------
                                       Enter [Y]es or [N]o > 
------------------------------
Index found files into splunk?
------------------------------
                             Enter choice: All/Some/[None] > 0
2010-05-06 16:41:54,364 INFO splunk_data :: report_item_fspath='/Users/hstest_find_ascii' file_name='test_found.py' test_name='test_find_ascii' test_result='PASSED' error_message=''
2010-05-06 16:41:54,364 INFO conftest :: RUNTEST_TEARDOWN test_ascii runtime=163

Currently splunk sees this as two events:

2010-05-06 16:41:18,082 ...
    Thu May  6 16:40:42 2010 ...

How can I correctly extract the timestamp to turn the sample log above as three events?

2010-05-06 16:41:18,082 ...
2010-05-06 16:41:54,364 ...
2010-05-06 16:41:54,364 ...

My props.conf in etc/apps/my-app/local/props.conf looks like this:

[sourcetype::testlog]
MAX_TIMESTAMP_LOOKAHEAD = 25
Tags (1)
0 Karma

marcoscala
Builder

Simon gave the best answer.

First of all, you have to tell Splunk that this is a multi line event, and then when the log should be broken into an event. In your case use this directive in props.conf:

[source::testlog]
BREAK_ONLY_BEFORE_DATE = true

Honestly I'm not 100% sure and I would check if the second line is considered an event-breaker or not.

Regards, Marco Scala - Consoft

0 Karma

Simon_Shelston
Splunk Employee
Splunk Employee

This appears to be a line breaking issue.

Try adding the following to props.conf:

BREAK_ONLY_BEFORE_DATE = true

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...