Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Line breaking does not work for events with the same timestamp

$
0
0

Help please! Our data looks like the one below....

1377190800,ANAQUA_VMs,52940532,987100964550,Normal,0,161792,50,18623,4.29447,3.02706
1377190800,ANAQUA_VMs,ANAQUA_VMs-ETC,P,166810,47232,33,8

And here is our props.conf file. I believe we have tried all possible combinations of lin breaking parameters but none of them seem to work for us...

TIME_PREFIX = ^
TIME_FORMAT = %s
MAX_TIMESTAMP_LOOKAHEAD = 10
TZ = UTC
#LINE_BREAKER=([\r\n]+)
BREAK_ONLY_BEFORE_DATE = true
#SHOULD_LINEMERGE = false
#MUST_BREAK_AFTER = ([\r\n]+)

Thanks in advance!


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>