topic Re: Problems with File Import and props.conf in Getting Data In

Problems with File Import and props.conf

tpaulsen — Fri, 19 Aug 2011 13:11:35 GMT

Hello,

we use Splunk 4.1.7 and we would like to import once every night a file with the following content:

19702800;  2;00;  5377;     0; 0; 0; 0;002/00;     5;     1158;     0; 8;001401;       22727;          11;      272042 
 19706400;  2;00;  2924;     0; 0; 0; 0;002/00;     4;     1158;     0; 8;001401;       12123;          12;      425960 
 19710000;  2;00;  1163;     0; 0; 0; 0;002/00;     1;     1158;     0; 8;001401;        4953;          12;      487065

The file is about 3MB big.

We want each line to be indexed in Splunk as a single event.
For that purpose i wrote the following entry in our props.conf:

[mysourcetypename]
KV_MODE = none
MAX_EVENTS = 1
SHOULD_LINEMERGE = false

[source::.../var/MYFILEWITHDATA.TXT]
sourcetype = mysourcetypename

Despite this props.conf the first 258 lines of the file will always get imported as a big multiline event, before with line 259 Splunk starts to import each line as single events.
I can´t find any problems within the datafile, so what is causing this behaviour and how can we get Splunk to break each line into a single event?

Thank you in advance,

with kind regards, Thomas Paulsen

Re: Problems with File Import and props.conf

lguinn2 — Sun, 21 Aug 2011 15:26:14 GMT

What happens if you put the 'sourcetype=mysourcetypename' in your inputs.conf under the appropriate monitor stanzas?

What happens if you disable the '[mysourcetype]' stanza?

Re: Problems with File Import and props.conf

tpaulsen — Mon, 22 Aug 2011 07:29:58 GMT

My inputs.conf looks like this:

[monitor:///var/MYFILEWITHDATA.TXT]
disabled = false
host = splunk-a
index = idx_mystatistik
crcSalt = <SOURCE>
sourcetype = mysourcetypename

If i don´t have the crcSalt stanza and the props.conf defintion, then everything gets imported as one single big chunky multilineevent.