topic Re: Splunk incorrect default line breaking in Getting Data In

Splunk incorrect default line breaking- What am I doing wrong?

phamxuantung — Fri, 03 Mar 2023 18:09:24 GMT

Hello, I have a sourcetype that have a default LINE_BREAKING and SHOULD_LINEMERGE=false, like so:

Per my understanding, this mean it automatically extract each line as one event. But the indexed data is like this:

The red event is correct with linecount=1, but most of the events have linecount=2, some have event more without line breaking. So what should I fix?

Re: Splunk incorrect default line breaking

gcusello — Fri, 03 Mar 2023 07:50:36 GMT

Hi @phamxuantung,

where did you located this props.conf?

it must be located on Indexers and (if present) on intermediate Heavy Forwarders, not on Universal Forwarders.

Ciao.

Giuseppe

Re: Splunk incorrect default line breaking

phamxuantung — Fri, 03 Mar 2023 08:20:45 GMT

This props.conf is in my /splunk/etc/apps/search/local and made in my search head (Setting -> Source types -> New Source type). We have a structure of 1 Master (and where we manage deployment apps) 1 search head and 4 indexer cluster. In most case, we create source type directly in our Search head. So you're telling me I should have setup props.conf in my indexer cluster for it to work correctly?

Re: Splunk incorrect default line breaking

phamxuantung — Fri, 03 Mar 2023 09:52:59 GMT

I setup for sourcetype in props.conf in my indexer with

LINE_BREAKER = ([\r\n]+)

SHOULD_LINEMERGE = false

But it still indexed with incorrect line break

Re: Splunk incorrect default line breaking

LRF — Fri, 03 Mar 2023 10:33:29 GMT

hi @phamxuantung LINE_BREAKER is applied during the Parsing Pipeline, so the instance with the LINE_BREAKER and SHOULD_LINEMERGE = false (merging pipeline) must be set on HF/Indexer level.

LINE_BREAKER on Search Heads would work if that Search Heads are directly indexing events (i.e. in Splunk all-in-one architectures), hence parsing events themself.

Hope this helps,

Fabrizio