https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476051#M81690 <P>Duplicate of <A href="https://answers.splunk.com/answers/771915/index-time-not-getting-captured-correctly.html">https://answers.splunk.com/answers/771915/index-time-not-getting-captured-correctly.html</A></P> Fri, 13 Sep 2019 08:10:29 GMT harsmarvania57 2019-09-13T08:10:29Z https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476048#M81687 <P>{"alarm": {"attribute": [{"@id": "0x10000", "$": "SwCiscoIOS"}, {"@id": "0x11d42", "$": "tfotaprdhkap002"}, {"@id": "0x12022", "$": "0"}, {"@id": "0x12c05", "$": "Directly Managed"}, {"@id": "0x13345", "$": "0"}, {"@id": "0x12a07", "$": "0"}, {"@id": "0x12a06", "$": "0"}, {"@id": "0x1000a", "$": "2"}, {"@id": "0x11f4d", "$": "false"}, {"@id": "0x12b4c", "$": "AGENT SNMP NOT RESPONDING TO POLLS"}, {"@id": "0x11f4e", "$": "1568288097"}, {"@id": "0x1006e", "$": "sacctok0602.jp.world.socgen"}, {"@id": "0x11f50", "$": "67329"}, {"@id": "0x11f57", "$": "true"}, {"@id": "0x11f56", "$": "2"}, {"@id": "0x11f9b", "$": "false"}, {"@id": "0x129fa", "$": "0x92833e"}, {"@id": "0x11f9c", "$": "5d7a2d61-f9ca-1567-035e-00801005f81c"}, {"@id": "0x12d7f", "$": "176.3.250.18"}], "@id": "5d7a2d61-f9ca-1567-035e-00801005f81c"}, "@preexisting": false}, {"alarm": {"attribute": [{"@id": "0x10000", "$": "SwCiscoIOS"}, {"@id": "0x11d42", "$": "psehlx20"}, {"@id": "0x12022", "$": "0"}, {"@id": "0x12c05", "$": "Directly Managed"}, {"@id": "0x13345", "$": "0"}, {"@id": "0x12a07", "$": "0"}, {"@id": "0x12a06", "$": "0"}, {"@id": "0x1000a", "$": "0"}, {"@id": "0x11f4d", "$": "false"}, {"@id": "0x12b4c", "$": "TRAP LINK DOWN IS RECEIVED"}, {"@id": "0x11f4e", "$": "1568288101"}, {"@id": "0x1006e", "$": "PDC-SW-N47_01.eu.newedge.int"}, {"@id": "0x11f50", "$": "2228225"}, {"@id": "0x11f57", "$": "true"}, {"@id": "0x11f56", "$": "1"}, {"@id": "0x11f9b", "$": "true"}, {"@id": "0x129fa", "$": "0x1b30db"}, {"@id": "0x11f9c", "$": "5d7a2d65-d81a-1dba-031e-008010400a87"}, {"@id": "0x12d7f", "$": "195.118.1.40"}], "@id": "5d7a2d65-d81a-1dba-031e-008010400a87"}, "@preexisting": false},</P> <P>it should break at {"alarm":</P> Thu, 12 Sep 2019 11:46:37 GMT https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476048#M81687 surekhasplunk 2019-09-12T11:46:37Z https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476049#M81688 <P>What are the current props.conf settings for this sourcetype?<BR /> Have you tried <CODE>LINE_BREAKER = (){"alarm":</CODE>?</P> Thu, 12 Sep 2019 12:04:39 GMT https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476049#M81688 richgalloway 2019-09-12T12:04:39Z https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476050#M81689 <P>yes line break is happening but taking only 1 event not all</P> Fri, 13 Sep 2019 00:14:51 GMT https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476050#M81689 surekhasplunk 2019-09-13T00:14:51Z https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476051#M81690 <P>Duplicate of <A href="https://answers.splunk.com/answers/771915/index-time-not-getting-captured-correctly.html">https://answers.splunk.com/answers/771915/index-time-not-getting-captured-correctly.html</A></P> Fri, 13 Sep 2019 08:10:29 GMT https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476051#M81690 harsmarvania57 2019-09-13T08:10:29Z https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476052#M81691 <P>Hi surekhasplunk,<BR /> what's your architecture: have you an Heavy Forwarder or not?<BR /> where do you locate the props.conf?</P> <P>props.conf must be located on Indexers and (if present) on Heavy Forwarders.</P> <P>Bye.<BR /> Giuseppe</P> Fri, 13 Sep 2019 11:01:36 GMT https://community.splunk.com/t5/Getting-Data-In/linebreaker-not-working/m-p/476052#M81691 gcusello 2019-09-13T11:01:36Z