https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89000#M18467 <P>I have a big file about 17G,when I input it as a file,splunk treat some record as multi-line.<BR /> The file is UTF-8 Unicode text.<BR /> how can I force splunk read file line by line ?<BR /> Thank you very much!</P> Sat, 13 Oct 2012 00:41:03 GMT perlish 2012-10-13T00:41:03Z https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89000#M18467 <P>I have a big file about 17G,when I input it as a file,splunk treat some record as multi-line.<BR /> The file is UTF-8 Unicode text.<BR /> how can I force splunk read file line by line ?<BR /> Thank you very much!</P> Sat, 13 Oct 2012 00:41:03 GMT https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89000#M18467 perlish 2012-10-13T00:41:03Z https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89001#M18468 <P>You need to configure props.conf in order to force splunk index data with single line.<BR /> The configuration will be following.</P> <P>[your_sourcetype]<BR /> SHOULD_LINEMERGE = false</P> <P>You can also refer to the manual as bellow.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Indexmulti-lineevents" target="_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Indexmulti-lineevents</A></P> Mon, 28 Sep 2020 12:37:28 GMT https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89001#M18468 Takajian 2020-09-28T12:37:28Z https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89002#M18469 <P>it works!<BR /> Thank you !<BR /> the manual are powerful!</P> Sat, 13 Oct 2012 07:24:24 GMT https://community.splunk.com/t5/Getting-Data-In/how-can-I-force-splunk-read-file-line-by-line/m-p/89002#M18469 perlish 2012-10-13T07:24:24Z