Getting Data In

Can you help me with props.conf in line breakage?

vrmandadi
Builder

link textI want to break the events where you see the bolded timestamps below, like 12:17:50.267,12:17:50.268 etc

Below is the sample event

12:17:50.267 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Preprocessing of job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING} done.12:17:50.268 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Transaction started for job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING}.12:17:50.382 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING} done.

i am using the below props.conf

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\d{2}\:\d{2}\:\d{2}\.\d{3}
0 Karma

vrmandadi
Builder

I got it using line breaker helped

DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
LINE_BREAKER=(\d{2}:\d{2}:\d{2}.\d{3})

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
try this

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=(\d{2}\:\d{2}\:\d{2}\.\d{3})

Bye.
Giuseppe

0 Karma

vrmandadi
Builder

It did not break,I will attach the raw data file in the question to see if that works ad that is the same thing I posted in the question

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
modify the regex in

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=(\d+:\d+:\d+\.\d+\s\[)

Bye.
Giuseppe

0 Karma

ssadanala1
Contributor

Here is props.conf for the File

SHOULD_LINEMERGE=false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{3}
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
TIME_FORMAT = %H:%M:%S.%3Q
" Test and Validate before deploying"

Cheers

0 Karma

vrmandadi
Builder

I tested it,it is not working

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @vrmandadi,

Could you be more clear about what you need help with? Thanks for posting!

0 Karma

vrmandadi
Builder

I want to break the events where you see the timestamp like 12:17:50.267,12:17:50.268 etc

0 Karma

vrmandadi
Builder

Am I clear or do I need to add more information

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...