topic Re: line-break issues in events in Getting Data In

line-break issues in events

fisuser1 — Tue, 29 Sep 2020 14:06:10 GMT

I'm having issues with line break for some reason. I'm looking to break into individual line events. I've included the following in the specific apps props.conf. Any suggestions?

props.conf
[SPLUNK_INCL_DATA.DAT]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

raw data
y8200|ACH-NEW-R|05/16/2017|7|1|5|881.24|3|50.24|INC_ACH-NEW-R3-0516.PBS|05/16/2017|2|397|
y8200|ACH-NEW-R|05/16/2017|8|1|0|0.00|1|412.00|INC_ACH-NEW-R4-0516.PBS|05/16/2017|||
y8200|ACH-R|05/16/2017|1|1|27332|19348046.77|11142|10812534.28|INC_ACH-R1-0516.PBS|05/16/2017|5|33|
y8200|ACH-R|05/16/2017|2|1|43093|106558388.19|40396|117051987.96|INC_ACH-R2-0516.PBS|05/16/2017|||
y8200|ACH-R|05/16/2017|3|1|14949|6935959.69|5846|5575650.96|INC_ACH-R3-0516.PBS|05/16/2017||0|
y8200|ACH-R|05/16/2017|4|1|11145|2342435.86|4304|5653510.66|INC_ACH-R4-0516.PBS|05/16/2017|||

Re: line-break issues in events

woodcock — Wed, 17 May 2017 12:49:05 GMT

You need to:

Make sure that the sourcetype in the stanza header matches EXACTLY the sourcetype of your data.
Deploy this to each of your indexers
Restart splunk on each indexer
Test by searching ONLY against data indexed AFTER the deploy/restart (old data will stay broken)

Re: line-break issues in events

aakwah — Tue, 29 Sep 2020 14:06:13 GMT

Hello,

According to docs what you are doing should work fine, however it doesn't work for me as well.

For sample logs you have provided, the following worked fine:

props.conf
[SPLUNK_INCL_DATA.DAT]
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE = ($)

Regards

Re: line-break issues in events

aakwah — Fri, 19 May 2017 08:00:36 GMT

I gave a try again with LINE_BREAKER = ([\r\n]+) and It worked fine on version 6.5.3

Re: line-break issues in events

gvnd — Fri, 19 May 2017 13:14:31 GMT

working fine, But how.? could you please explain.?

Thanks in advance

Re: line-break issues in events

aakwah — Fri, 19 May 2017 14:00:48 GMT

Hello,
$ matches the end of the line, it is working the same like ^ with start of the line
Regards

Re: line-break issues in events

khalidewaidah — Fri, 30 Jun 2017 23:18:56 GMT

Hi ,
1- Where is props.conf stored & let me know this change will impact all logs or specific log .
2- Can I enforce splunk to monitor log line by line using input.conf

Re: line-break issues in events

prathapkcsc — Fri, 30 Jun 2017 23:24:15 GMT

props.conf file location : $SPLUNK_HOME/etc/system/local
Inside the directory you find props.conf,in case if you don't have create new one with props.conf name.
Place that code inside file after restart the splunkd service.