https://community.splunk.com/t5/Getting-Data-In/monitor-records-several-lines-in-one-raw/m-p/186349#M37334 <P>This doesn't have anything to do with what you configure in inputs.conf, rather it's related to how Splunk is breaking data into events. For more information, read here: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Indexmulti-lineevents">http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Indexmulti-lineevents</A></P> Thu, 13 Mar 2014 15:14:34 GMT Ayn 2014-03-13T15:14:34Z https://community.splunk.com/t5/Getting-Data-In/monitor-records-several-lines-in-one-raw/m-p/186348#M37333 <P>Hello <BR /> I have a file with 30 lines that want to register in Splunk. <BR /> After you have configured the inputs.conf the splunk _raw saved one, with all lines of the file, when they should be 30 _raw <BR /> This is my configuration inputs.conf <BR /> I will be failing in something? </P> <PRE><CODE>[monitor:///var/log/splunk/data_clientes.log] index = main source = txt host = SIEM SourceType = customers disabled = false </CODE></PRE> Thu, 13 Mar 2014 14:55:04 GMT https://community.splunk.com/t5/Getting-Data-In/monitor-records-several-lines-in-one-raw/m-p/186348#M37333 jrodriguezap 2014-03-13T14:55:04Z https://community.splunk.com/t5/Getting-Data-In/monitor-records-several-lines-in-one-raw/m-p/186349#M37334 <P>This doesn't have anything to do with what you configure in inputs.conf, rather it's related to how Splunk is breaking data into events. For more information, read here: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Indexmulti-lineevents">http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Indexmulti-lineevents</A></P> Thu, 13 Mar 2014 15:14:34 GMT https://community.splunk.com/t5/Getting-Data-In/monitor-records-several-lines-in-one-raw/m-p/186349#M37334 Ayn 2014-03-13T15:14:34Z