Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I break a multi-line event with regex, provided that the date is changed and the event should break only when they have the date at the beginning of the interaction?

$
0
0
Hello, How can I break this multiline event, with the condition if the date is changed and only the date at the beginning of the line. This log has dates in the middle of the line, but this event cannot be broken, it has to be only at the beginning. 2019-11-12T09:51:28.291 Dbg 23058 [MsgIn] Ended defined Clients : 2019-11-12T09:51:28.338 Dbg 23055 [MsgIn] None. 2019-11-12T09:51:28.338 Dbg 23056 [MsgIn] Scheduled Clients : 2019-11-12T09:51:28.338 Dbg 23055 [MsgIn] None. 2019-11-12T09:51:36.154 Trc 29998 [PSDK.Timer] -AP[8802]->-65331 @09:51:36.0154 2019-11-12T09:51:36.154 Trc 29998 [O worker #4] -Ap[8802]-<-65331 @09:51:36.0154 2019-11-12T09:51:51.145 Trc 29998 [PSDK.Timer] -AP[4563]->-58089 @09:51:51.0145 2019-11-12T09:51:51.145 Trc 29998 [O worker #4] -Ap[4563]-<-58089 @09:51:51.0145 2019-11-12T09:51:53.657 Trc 29998 [PSDK.Timer] -AP[5040]->-59427 @09:51:53.0657 2019-11-12T09:51:53.657 Trc 29998 [O worker #3] -Ap[5040]-<-59427 @09:51:53.0657 Timezone UTC offset: 03:00:00 UTC Start Time: 2019-11-09T05:25:11.154 Running Time (DDD:HH:MM:SS): 003:07:26:17 UTC Time: 2019-11-12T12:51:28.338 2019-11-12T09:52:28.367 Dbg 23053 [MsgIn] Clients defined in ConfigServer : 2019-11-12T09:52:28.367 Dbg 23054 [MsgIn] enabled. 2019-11-12T09:52:28.367 Dbg 23054 [MsgIn] enabled. 2019-11-12T09:52:28.367 Dbg 23054 [MsgIn] enabled.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>