https://community.splunk.com/t5/Splunk-Dev/Break-reports/m-p/46815#M628 <P>Damn - I didn't stop and restart the daemon. Idiot.</P> <P>Ignore please - works fine now!</P> Tue, 10 Jan 2012 14:34:52 GMT derekclarke 2012-01-10T14:34:52Z https://community.splunk.com/t5/Splunk-Dev/Break-reports/m-p/46814#M627 <P>I am importing logfiles into Splunk from a file. Each log entry starts with the string "** Alert" and ends with a double paragraph mark. The log entries are multi-line and of variable length, and a combination of various sources (windows alerts, firewall alerts etc).</P> <P>When importing, I click 'A file or directory of files'; 'Consume any file on this Splunk server'; 'Upload and index a file'; then browse for the file and click save.</P> <P>No matter what I try in props.conf, each log entry begins with the date (which is the SECOND line of the entry) and ends with the "** Alert" from the next extry. I am editing the [default] section. (I have copied props.conf from /etc/system/default into etc/system/local and this is the one I'm editing).</P> <P>Can someone suggest a suitible setting in props.conf or is it that I have to do something to make Splunk use the default part of props.conf rather than making its own mind up about what sort of file it's importing?</P> <P>TIA</P> Tue, 10 Jan 2012 14:05:17 GMT https://community.splunk.com/t5/Splunk-Dev/Break-reports/m-p/46814#M627 derekclarke 2012-01-10T14:05:17Z https://community.splunk.com/t5/Splunk-Dev/Break-reports/m-p/46815#M628 <P>Damn - I didn't stop and restart the daemon. Idiot.</P> <P>Ignore please - works fine now!</P> Tue, 10 Jan 2012 14:34:52 GMT https://community.splunk.com/t5/Splunk-Dev/Break-reports/m-p/46815#M628 derekclarke 2012-01-10T14:34:52Z