topic Why is my props.conf should_linemerge=false configuration being ignored for json objects? in Getting Data In

Why is my props.conf should_linemerge=false configuration being ignored for json objects?

paulelms — Mon, 02 Feb 2015 15:53:26 GMT

Hello! Sorry for my bad english.

My props.conf file:

[testudp]
SHOULD_LINEMERGE = false

I have several json objects (each on its own line) merged into one event. Best of problem is shown in the screenshots:

merged objects: http://take.ms/9q90D
line breaks proof: http://take.ms/u92oi

I tried some other tweaks found here, but nothing happens. I hope very much for your help. Thanks in advance.

Sorry for passive links, limitations for new user.

Re: Why is my props.conf should_linemerge=false configuration being ignored for json objects?

markthompson — Fri, 20 Feb 2015 14:07:14 GMT

Hi Paulelms, can you tell me if it's showing Sourcetype=testudp on your events, if not, please re-configure your UDP input with the following settings;

Restart your Splunk instance (ensuring props.conf is saved first)
On the new UDP input, select sourcetype = testudp

After doing the above, it should recognise the sourcetype being testudp and then will implement the SHOULD_LINEMERGE attribute.

Re: Why is my props.conf should_linemerge=false configuration being ignored for json objects?

paulelms — Fri, 20 Feb 2015 14:10:55 GMT

Screen: http://take.ms/t6rGN

Re: Why is my props.conf should_linemerge=false configuration being ignored for json objects?

markthompson — Fri, 20 Feb 2015 14:13:56 GMT

Ok, so restart your splunk instance, and then go to New UDP input, and select from the SOURCETYPE dropdown, the testUDP sourcetype, not the source.

Hope this helps

Re: Why is my props.conf should_linemerge=false configuration being ignored for json objects?

paulelms — Fri, 20 Feb 2015 14:33:34 GMT

Thanks Sir!!!

Re: Why is my props.conf should_linemerge=false configuration being ignored for json objects?

markthompson — Fri, 20 Feb 2015 14:39:31 GMT

No problem