I have a problem with this file:
-----------------------------------
CLIENT 100
GUID 4F281780E49E1DC0E10080000A1E8680
INPUT_DATA SAP_SYSTEM=LD1;SAP_CLIENT=100;TITLE=Visning af tatusrecord;Function code that PAI triggered=BACK;WE02.SAPLEDI5.0100.SAPLEDI5.0100.EDI_INTDS.DOCNUM[0]()=0000000000049301;
OUTPUT_DATA SAP_SYSTEM=LD1;SAP_CLIENT=100;
CREATED_AT 20120201123559
CREATED_BY SZT
CHANGED_AT 20120201123559
CHANGED_BY SZT
TIMESTAMP 20120201093938
TRX_NAME WE02
USERNAME SZT
CLIENT_PC 172.28.240.189
TECHNOLOGY 10
----------------------------------------
I use the following configuration:
BREAK_ONLY_BEFORE=^CLIENT\s+\d{3}
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=14
TIME_FORMAT=%Y%m%d%H:%M:%S
TIME_PREFIX=TIMESTAMP\s+
But it is like Splunk reads to much into the timestamp even though I use “MAX_TIMESTAMP_LOOKAHEAD=14”
Splunk reports this error.
-Could not use strptime to parse timestamp from "20120201093938\nTRX_NAME WE02\nUSERNAME SZT\n
CLIENT_PC"
Hope some one can help me
Your TIME_FORMAT specifies colons; the time stamp I can see from your event sample doesn't have any. Try %Y%m%d%H%M%S.
Splunk is quite clever, sometimes its better to let it try and handle as much as possible, using the data above the following props performs the multiline extraction and timestamping correctly;
BREAK_ONLY_BEFORE=CLIENT\s+
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_PREFIX=TIMESTAMP
Who knows! I didn't have time to test it. Sometimes in Splunk if you try to be too specific you can end up with conflicting configurations that try to do things in different orders. There are probably a few wonky bits 🙂 Feel free to click the tick next to my answer to accept if its all working now!
It works!, but why did the other configuration not work?