Need to line break on timestamp in the following log record, but the underscore in the timestamp is throwing me off. Any help would be appreciated and thank you!
2015-07-28_09:51:02 INFO App=EXTRACT_HIT_DATA Message=::' Checking for backlog file/files to process '
2015-07-28_09:51:02 INFO App=EXTRACT_HIT_DATA Message=:' Number of backlog files : 48'
2015-07-28_09:51:02 INFO App=EXTRACT_HIT_DATA Message=:' Start processing all available backlog files '
2015-07-28_09:51:02 WARNING App=EXTRACT_HIT_DATA Message=:' File /nas/abc/myx/myarchive/omniture/feed/.../xyz.fin still not available, will try to process the file again during next run.'
2015-07-28_09:51:02 WARNING App=EXTRACT_HIT_DATA Message=:' File /nas/abc/myx/myarchive/omniture/feed/.../xyz.fin still not available, will try to process the file again during next run.'
2015-07-28_09:51:02 WARNING App=EXTRACT_HIT_DATA Message=:' File /nas/abc/myx/myarchive/omniture/feed/.../xyz.fin still not available, will try to process the file again during next run.'
you'll want to create a props.conf file that sits with your inputs.conf file. - Change "yoursourcetype" to the sourcetype you've defined in inputs.conf
[yoursourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 20
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%d_%H:%M:%S
TIME_PREFIX = ^
you'll want to create a props.conf file that sits with your inputs.conf file. - Change "yoursourcetype" to the sourcetype you've defined in inputs.conf
[yoursourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 20
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%d_%H:%M:%S
TIME_PREFIX = ^
Will that break at timestamp?
I think the lookahead and no linemerge would allow it to break properly is that correct?
Yep - Splunk will automatically break on the timestamp unless you manually define a line breaker.
Within your props.conf you need to specify the ** TIME_FORMAT**.
#props.conf
[mysource]
TIME_FORMAT = < strptime >
Use this reference Configuretimestamprecognition
So what would that make LINE_BREAKER look like then or should I use it? Considering I need to break on timestamp.