topic Re: Configuration of props.conf and input.conf in Getting Data In

Configuration of props.conf and input.conf

edrivera3 — Mon, 28 Sep 2020 19:59:15 GMT

Hi
I am interested to upload two distinct files form multiple directories. I have done this previously by using Splunk-web, but now I am trying to do it by modifying props.conf and input.conf. So I have two files that have two different extension. So I believe my input.conf goes like this

[monitor://C:/User/.../Data/...]
index = my_index1
sourcetype = my_sourcetype1
whitelist = .tir$
initCrcLength = 4000

[monitor://C:/User/.../Data/...]
index = my_index2
sourcetype = my_sourcetype2
whitelist = .JobEvent$
initCrcLength = 4000

Both sourcetype are custom. The events are very long. I am no sure if I'm starting the stanza correctly with the sourcetype. Please let me know I if this look right.

[my_sourcetype1]
SHOULD_LINEMERGER = true
NO_BINARY_CHECK = true
disabled = false
pulldown_type = true
category = Custom
MAX_EVENTS = 100000
BREAK_ONLY_BEFORE = Massabeeldiabloporviejoquepordiablo

[my_sourcetype2]
SHOULD_LINEMERGER = true
NO_BINARY_CHECK = true
disabled = false
pulldown_type = true
category = Custom
MAX_EVENTS = 100000
BREAK_ONLY_BEFORE = Massabeeldiabloporviejoquepordiablo

Re: Configuration of props.conf and input.conf

woodcock — Tue, 19 May 2015 16:00:47 GMT

IMHO, this should work but you may still find events broken/terminated/truncated due to other limits; see here:
http://answers.splunk.com/answers/4162/size-limit-for-an-event.html

Re: Configuration of props.conf and input.conf

edrivera3 — Tue, 19 May 2015 16:10:19 GMT

For now I cannot do much about those long files. In the future my plan is to parse all those files and create new files with a different structure/format that would be easier to divide them in multiple events, but that's another project. Thanks for your response.