https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229679#M44694 <P>thanks for your answer but please can you clarify the doubt<BR /> Does it means that the path of the directory from where the logs are being monitored?? </P> Mon, 27 Jun 2016 15:37:43 GMT saifuddin9122 2016-06-27T15:37:43Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229677#M44692 <P>Hello </P> <P>My question is, can we write props.conf to break events</P> <P>I have written this in the following way. Can some body suggest me that whether I am going in the right direction?</P> <PRE><CODE>[source::backlogs] SHOULD_LINEMERGE = false </CODE></PRE> Mon, 27 Jun 2016 15:21:17 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229677#M44692 saifuddin9122 2016-06-27T15:21:17Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229678#M44693 <P><CODE>[source::backlogs]</CODE> should contain the full path to the proper log files, something like <CODE>[source::/var/lib/backlogs/*.log]</CODE> </P> Mon, 27 Jun 2016 15:29:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229678#M44693 ddrillic 2016-06-27T15:29:06Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229679#M44694 <P>thanks for your answer but please can you clarify the doubt<BR /> Does it means that the path of the directory from where the logs are being monitored?? </P> Mon, 27 Jun 2016 15:37:43 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229679#M44694 saifuddin9122 2016-06-27T15:37:43Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229680#M44695 <P>Right - that's it.</P> Mon, 27 Jun 2016 15:41:32 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229680#M44695 ddrillic 2016-06-27T15:41:32Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229681#M44696 <P>Thanks again<BR /> now i have got a clear view</P> Mon, 27 Jun 2016 15:46:10 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229681#M44696 saifuddin9122 2016-06-27T15:46:10Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229682#M44697 <P>You are most welcome. </P> Mon, 27 Jun 2016 15:47:41 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229682#M44697 ddrillic 2016-06-27T15:47:41Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229683#M44698 <P>hello <BR /> i have tried as you mentioned<BR /> but it didn't worked can you please point me where am doing wrong<BR /> my props.conf looks like</P> <P>[source::/var/log/output/output.log]<BR /> SHOULD_LINEMERGE = false</P> Mon, 27 Jun 2016 16:35:02 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-configure-props-conf-to-break-events-by-source/m-p/229683#M44698 saifuddin9122 2016-06-27T16:35:02Z