Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to fix the timestamp for multiline events?

$
0
0
Hi, Kindly help me out with to solve this question When I try to parse the log event data into splunk which is in the multiline format, the timestamp is not identified correctly by splunk. It shows error that it "failed to parse timestamp". how to resolve this issue. My log will be looking like this: **20190723**1345267473.00 10-24-00 aaaa bbbbb cccccc here date is 2019-07-23 and time is 10-24-00 But these two line are identified as single event by enabling SHOULD_LINEMERGE = true

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>