topic Re: Searching a line from text file in Getting Data In

Searching a line from text file

shantanuo — Tue, 01 Nov 2011 12:02:52 GMT

I have a file with semi colon ; line breaks text file. It has been indexed in splunk.

 INSERT INTO `account` VALUES ('abc');
 INSERT INTO `account` VALUES ('xyz');
 INSERT INTO `account` VALUES ('pqr');
 INSERT INTO `account` VALUES ('mnp');

When I search for "pqr" it should show only 1 line. It is currently showing the next line "mnp" as well. There is no timestamp in the file and splunk still is grouping the lines by date-time. for e.g. all the lines mentioned above listed as a group under 06/09/2011 19:01:17.000

How do I return only one line while searching for 'pqr' ?

Re: Searching a line from text file

Ayn — Tue, 01 Nov 2011 13:05:02 GMT

You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.

You want to set SHOULD_LINEMERGE to "false" in props.conf (default is true). That way Splunk will not merge lines into combined events.

Re: Searching a line from text file

shantanuo — Wed, 02 Nov 2011 02:54:22 GMT

Thanks, this is working. But I guess it will affect all the indexes. Is it possible to index only this file with semi colon ; as line_breaker ?

Re: Searching a line from text file

Ayn — Wed, 02 Nov 2011 07:17:29 GMT

Sure, just define which source or sourcetype you want this setting to apply to in props.conf, e.g. for a source you would do

[source:///path/to/file]
SHOULD_LINEMERGE = false

or to do it on a sourcetype level,

[your_sourcetype]
SHOULD_LINEMERGE = false