topic Re: Props.conf file changes in Getting Data In

Props.conf file changes

prathapkcsc — Tue, 29 Sep 2020 14:36:59 GMT

Hi,
my sample data like this
101,Mango,0.40%
102,Orange,0.70%
It is coming as a single event, as i want to split into multiple events based on new line escape character.
What changes do i need to made in props.conf file
My sourcetype is "abc"
My props.conf looks like this
props.conf:
[abc]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

Anyone help me?
Thank you.

Re: Props.conf file changes

woodcock — Thu, 29 Jun 2017 18:40:19 GMT

That should do it. so check these:

The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.

Re: Props.conf file changes

prathapkcsc — Thu, 29 Jun 2017 20:56:19 GMT

Working now, I just restarted the splunkd service.
Thanks for your help!