If the divider of logs is set at DateTime value, how do you get Splunk to return one log instead of two?

[sfilipov]

We have divider of logs as DateTime value. If Splunk forwarder sees DateTime value in the string, it forms other log-records in the server. Look at the screenshot: we can see 2 parts of one log, but we need whole 1 log

Thanx 🙂

[harsmarvania57]

Hi @sfilipov,

You can set below configuration on Indexer or Heavy Forwarder which ever comes first from Universal Forwarder to parse timestamp correctly and break line properly and then restart splunk on Indexer or Heavy Forwarder.

props.conf

[yoursourcetype]
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%:z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=29

[sfilipov]

not working for me 😞 maybe because sourcetype contains '-' symb?

    [evenue-raw]
    TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N%:z
    TIME_PREFIX=^
    MAX_TIMESTAMP_LOOKAHEAD=29

[harsmarvania57]

No, I don't think so - in sourcetype will create problem. How Universal Forwarder is sending data to Indexers (Directly to Indexer OR via Heavy Forwarder)? On which server you implemented above config and have you restarted splunk after changes (Data which is already indexed in splunk will not change, only new data will parse and index properly)?

[493669]

Add below stanza in props.conf

[<yoursourcetypeName>]
MAX_TIMESTAMP_LOOKAHEAD = 20
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = ^

[493669]

connverted to comment as @harsmarvania57 answer is more correct