Hi, Kindly help me out with to solve this question
When I try to parse the log event data into splunk which is in the multiline format, the timestamp is not identified correctly by splunk. It shows error that it "failed to parse timestamp". how to resolve this issue.
My log will be looking like this:
**20190723**1345267473.00
10-24-00 aaaa bbbbb cccccc
here date is 2019-07-23 and time is 10-24-00
But these two line are identified as single event by enabling SHOULD_LINEMERGE = true
↧