Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to break a multi-line event with regex, provided that the date and time containing the milliseconds changes only at the beginning of the line.

$
0
0
Hi, I have the following log format, How can I break this multiline event, with the condition if the date is changed only when the date containing time is at the beginning of the line. Example: 2019-11-12T12: 51: 28.338 2019-11-12T09:51:28.291 Dbg 23058 [MsgIn] Ended defined Clients : 2019-11-12T09:51:28.338 Dbg 23055 [MsgIn] None. 2019-11-12T09:51:28.338 Dbg 23056 [MsgIn] Scheduled Clients : 2019-11-12T09:51:28.338 Dbg 23055 [MsgIn] None. 2019-11-12T09:51:36.154 Trc 29998 [PSDK.Timer] -AP[8802]->-65331 @09:51:36.0154 2019-11-12T09:51:36.154 Trc 29998 [O worker #4] -Ap[8802]-<-65331 @09:51:36.0154 2019-11-12T09:51:51.145 Trc 29998 [PSDK.Timer] -AP[4563]->-58089 @09:51:51.0145 2019-11-12T09:51:51.145 Trc 29998 [O worker #4] -Ap[4563]-<-58089 @09:51:51.0145 2019-11-12T09:51:53.657 Trc 29998 [PSDK.Timer] -AP[5040]->-59427 @09:51:53.0657 2019-11-12T09:51:53.657 Trc 29998 [O worker #3] -Ap[5040]-<-59427 @09:51:53.0657 Timezone UTC offset: 03:00:00 UTC Start Time: 2019-11-09T05:25:11.154 Running Time (DDD:HH:MM:SS): 003:07:26:17 UTC Time: 2019-11-12T12:51:28.338 2019-11-12T09:51:58.353 Dbg 23053 [MsgIn] Clients defined in ConfigServer : -Ap[4564]-<-58089 @09:52:21.0160 2019-11-12T09:52:28.367 Dbg 23053 [MsgIn] Clients defined in ConfigServer : 2019-11-12T09:52:28.367 Dbg 23054 [MsgIn] enabled. 2019-11-12T09:52:28.367 Dbg 23054 [MsgIn] enabled. 2019-11-12T09:52:28.367 Dbg 23054 [MsgIn] enabled.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>