topic Re: split each line as separate event in Getting Data In

split each line as separate event

harishsundharam — Sat, 19 Jan 2019 08:40:28 GMT

I am getting disk space detail like below

root 13G 7.4G 4.1G 65% /
tmpfs 6.3G 0 6.3G 0% /dev/shm
sda1 500M 121M 353M 26% /boot
sdb1 43G 32G 8.8G 79% /data

But this has been showing in the single event, I want to get each line as a separate event with using linebreaker in PROS.conf.
Anyone help me to get this done

Re: split each line as separate event

richgalloway — Sat, 19 Jan 2019 13:35:48 GMT

What are your existing props.conf settings for that sourcetype?

Re: split each line as separate event

harishsundharam — Tue, 29 Sep 2020 22:50:37 GMT

[ hdspace]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
MAX_TIMESTAMP_LOOKAHEAD=36
LINE_BREAKER=(\n\r)*

Re: split each line as separate event

richgalloway — Sun, 20 Jan 2019 16:09:17 GMT

Consider changing LINE_BREAKER to ([\r\n]*).