https://community.splunk.com/t5/Getting-Data-In/multirecord-key-value-input/m-p/28063#M4763 <P>I have a script that dumps data several lines at a time, each line has a set of key/value pairs eg:</P> <PRE><CODE>server=host1.blah.net, port=8080, requests=234, heap=20485 server=host2.blah.net, port=8080, requests=104, heap=46225, uptime=24325 server=host3.blah.net, port=8080, requests=234 </CODE></PRE> <P>I want splunk to treat each line as a separate log entry and whatever keys are present to be collected (e.g. like the result you get with autoKV). How do I setup props.conf and transforms.conf?</P> Wed, 15 Jun 2011 04:21:19 GMT deusaquilus 2011-06-15T04:21:19Z https://community.splunk.com/t5/Getting-Data-In/multirecord-key-value-input/m-p/28063#M4763 <P>I have a script that dumps data several lines at a time, each line has a set of key/value pairs eg:</P> <PRE><CODE>server=host1.blah.net, port=8080, requests=234, heap=20485 server=host2.blah.net, port=8080, requests=104, heap=46225, uptime=24325 server=host3.blah.net, port=8080, requests=234 </CODE></PRE> <P>I want splunk to treat each line as a separate log entry and whatever keys are present to be collected (e.g. like the result you get with autoKV). How do I setup props.conf and transforms.conf?</P> Wed, 15 Jun 2011 04:21:19 GMT https://community.splunk.com/t5/Getting-Data-In/multirecord-key-value-input/m-p/28063#M4763 deusaquilus 2011-06-15T04:21:19Z https://community.splunk.com/t5/Getting-Data-In/multirecord-key-value-input/m-p/28064#M4764 <P>you only need props.conf with the following:</P> <PRE><CODE>[&lt;yoursourcetype&gt;] SHOULD_LINEMERGE = False # If your events has no timestamp the config below will add current date/time as timestamp DATETIME_CONFIG = CURRENT KV_MODE = auto </CODE></PRE> Wed, 15 Jun 2011 09:59:24 GMT https://community.splunk.com/t5/Getting-Data-In/multirecord-key-value-input/m-p/28064#M4764 MarioM 2011-06-15T09:59:24Z