https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-for-Nagios-events/m-p/56768#M70361 <P>Currently when splunk eats the serviceperf and hostperf data the events come in as multi-line events. When in the nagios web view selecting splunk for a host may return a multi-line event that contains other hosts that came in at the same time. Is this as it should be? Would I be creating more problems by splitting the events so there is one single nagios event per event in splunk?</P> <P>Thanks in advance.</P> Tue, 24 Jan 2012 17:23:50 GMT kernand0 2012-01-24T17:23:50Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-for-Nagios-events/m-p/56768#M70361 <P>Currently when splunk eats the serviceperf and hostperf data the events come in as multi-line events. When in the nagios web view selecting splunk for a host may return a multi-line event that contains other hosts that came in at the same time. Is this as it should be? Would I be creating more problems by splitting the events so there is one single nagios event per event in splunk?</P> <P>Thanks in advance.</P> Tue, 24 Jan 2012 17:23:50 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-for-Nagios-events/m-p/56768#M70361 kernand0 2012-01-24T17:23:50Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-for-Nagios-events/m-p/56769#M70362 <P>Your props.conf should already have the following entry to ensure that each event is indexed as a single line:</P> <PRE><CODE>/opt/splunk/etc/apps/SplunkForNagios/default/props.conf [nagioshostperf] SHOULD_LINEMERGE = false [nagiosserviceperf] SHOULD_LINEMERGE = false </CODE></PRE> <P>You could try restarting splunk, I often find that this can solve line breaking issues <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>All the best,</P> <P>Luke <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 25 Jan 2012 03:17:37 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-for-Nagios-events/m-p/56769#M70362 lukeh 2012-01-25T03:17:37Z