Can you help me with props.conf in line breakage?

[vrmandadi]

link textI want to break the events where you see the bolded timestamps below, like 12:17:50.267,12:17:50.268 etc

Below is the sample event

12:17:50.267 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Preprocessing of job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING} done.12:17:50.268 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Transaction started for job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING}.12:17:50.382 [Output view job thread] INFO c.c.d.c.s.job.impl.JobServiceImpl - Job ActiveJob{id='33e60f2c-326e-4a43-b9e7-266d46453330', name='Export to "All Business Terms.xlsx".', user='8c6a6194-3283-4138-ad21-a63b9700a42f', state=RUNNING} done.

i am using the below props.conf

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\d{2}\:\d{2}\:\d{2}\.\d{3}

[vrmandadi]

I got it using line breaker helped

DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
LINE_BREAKER=(\d{2}:\d{2}:\d{2}.\d{3})

[gcusello]

Hi vrmandadi,
try this

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=(\d{2}\:\d{2}\:\d{2}\.\d{3})

Bye.
Giuseppe

[vrmandadi]

It did not break,I will attach the raw data file in the question to see if that works ad that is the same thing I posted in the question

[gcusello]

Hi vrmandadi,
modify the regex in

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=(\d+:\d+:\d+\.\d+\s\[)

Bye.
Giuseppe

[ssadanala1]

Here is props.conf for the File

SHOULD_LINEMERGE=false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{3}
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
TIME_FORMAT = %H:%M:%S.%3Q
" Test and Validate before deploying"

Cheers

[vrmandadi]

I tested it,it is not working

[mstjohn_splunk]

hi @vrmandadi,

Could you be more clear about what you need help with? Thanks for posting!

[vrmandadi]

I want to break the events where you see the timestamp like 12:17:50.267,12:17:50.268 etc

[vrmandadi]

Am I clear or do I need to add more information