topic Re: props.conf not working to break the events after pipe line in Splunk Enterprise

props.conf not working to break the events after pipe line

ashwinipatil007 — Wed, 30 Sep 2020 04:22:18 GMT

i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.

HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP

tried with below 2 props.conf.

[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)

[sourcetype]
BREAK_ONLY_BEFORE = (|)

I am using splunk 7.0 version

Re: props.conf not working to break the events after pipe line

nickhills — Fri, 28 Feb 2020 15:17:09 GMT

Do you not have timestamps in any of your events?

Re: props.conf not working to break the events after pipe line

nickhills — Fri, 28 Feb 2020 15:23:29 GMT

Hi @ashwinipatil007

Try the following in your props.conf

[sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\|)

It wont hurt putting this on your UF, but it wont do anything. This needs to be on your indexers, or (heavy forwarders if you use them)

Re: props.conf not working to break the events after pipe line

ashwinipatil007 — Tue, 03 Mar 2020 08:26:40 GMT

nope.
the props.conf are working fine when I try it before indexing the data but when I place them on HF (tried on UF as well) it is not breaking the events as expected.tried with below props.conf as well but no luck
I need to break the events before the PIPE in the above content.
any idea?