Hello guys
i am new at splunk and i am using splunk cloud trial
I have a log file like this, and my event so.
2017-07-31_15:46:26.625 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2017-07-31_15:46:26.813 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2017-07-31_15:46:26.920 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2017-07-31_15:46:26.922 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
i want to break events at " 2017-07-31_15:46:26.625 " .
My props.conf file
[testLinux]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = false
LINE_BREAKER = .*_[0-9]*:[0-9]*:[0-9]*.[0-9]*
TRUNCATE = 10000
NO_BINARY_CHECK = 1
i want to see events like this
event1 : 2017-07-31_15:46:26.625 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
event2 : 2017-07-31_15:46:26.813 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
event3 : 2017-07-31_15:46:26.920 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
event4 : 2017-07-31_15:46:26.922 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Anyone help me ? sorry for my bad english :)
↧