topic Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event? in Getting Data In

Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

pashtet13 — Wed, 06 Jul 2016 18:39:23 GMT

Hi,

I have a forwarder on a Windows server that is pulling logs from a folder. Logs are in a single file (multiple lines - each line per event).
Each event for that index contains multiple lines in Splunk.
I would like Splunk to separate lines so each line appears as a new event.
Please help me achieve this. I want to extract fields, but to do it, I need to have each line as a separate event.

Right now events look like this:

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

somesoni2 — Wed, 06 Jul 2016 18:46:32 GMT

What you need is to configure Line breaking for your log on Indexer/Heavy forwarder. Have a look at this to understand how splunk processes a log file data

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking

So, configure following on your indexer/Heavy forwarder

props.conf

[yoursourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

ddrillic — Wed, 06 Jul 2016 18:50:35 GMT

SHOULD_LINEMERGE = false in props.conf for the source, should do it.

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

pashtet13 — Wed, 06 Jul 2016 19:24:42 GMT

Thanks. I saw this document before. The issue is that there is no props.conf file in $SPLUNK_HOME/etc/system/local/
Our Splunk was initially configured by the consultant, that's why it's hard to make changes now.
I am pulling data with the deployment app I created. Should I create a props.conf file under the app itself?

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

aosso — Thu, 07 Jul 2016 06:47:15 GMT

Just create a new props.conf file with the desired configuration in $SPLUNK_HOME/etc/system/local/ on your indexer.

Make sure to restart Splunk to apply the changes.

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

ryanoconnor — Thu, 07 Jul 2016 12:03:06 GMT

Ideally you'll want to deploy as many changes as possible using the Deployment Server if you have one. But if you can't figure that out, than yes the changes mentioned above should get you where you need to go.