https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323529#M60249 <P>It has been already placed in indexers only. But still its not working as expected.</P> Mon, 23 Oct 2017 14:17:27 GMT anandhalagarasa 2017-10-23T14:17:27Z https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323527#M60247 <P>Hi Team,</P> <P>Currently we have the logs getting indexed into Splunk in this format but we require that each line has to be indexed separately in Splunk. </P> <P>But this didnt worked and hence once again we are getting all lines as a single event so kindly let me know the props.conf also how to monitor the same with the servername instead of sourcetype.</P> Mon, 23 Oct 2017 13:29:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323527#M60247 anandhalagarasa 2017-10-23T13:29:04Z https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323528#M60248 <P>Where in your environment is the props.conf file? If you're in a distributed environment, this should be on your indexers.</P> Mon, 23 Oct 2017 13:40:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323528#M60248 esix_splunk 2017-10-23T13:40:56Z https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323529#M60249 <P>It has been already placed in indexers only. But still its not working as expected.</P> Mon, 23 Oct 2017 14:17:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-we-split-the-lines-in-logs-as-individual-events/m-p/323529#M60249 anandhalagarasa 2017-10-23T14:17:27Z