line breaker event breaker

ryanaa — Thu, 14 Mar 2024 08:05:11 GMT

當我在SH設置好props.conf後去看我的uf端並重啟就會出現以下錯誤:

Checking conf files for problems...
Invalid key in stanza [web:access] in /opt/splunkforwarder/etc/apps/dynasafe_course_demo_ta/local/props.conf, line 3: ENVENT_BREAKER (value: ([\r\n]+)).
Invalid key in stanza [web:secure] in /opt/splunkforwarder/etc/apps/dynasafe_course_demo_ta/local/props.conf, line 6: ENVENT_BREAKER (value: ([\r\n]+)).
Your indexes and inputs configurations are not internally consistent.
這是怎麼回事

Re: line breaker event breaker

kiran_panchavat — Thu, 14 Mar 2024 08:52:28 GMT

@ryanaa Line breaking is not possible with the universal forwarder. The indexer or HF is responsible for that.

The EVENT_BREAKER setting is the only one that functions with UF; nevertheless, it simply instructs UF to identify the boundaries of events and causes it to deliver whole events to indexers.

Try to apply this settings on an heavy forwarder or indexer.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

topic line breaker event breaker in Getting Data In

line breaker event breaker

Re: line breaker event breaker