individual event: props.conf

msenthilganesh — Wed, 26 May 2010 21:11:27 GMT

I am expecting to see each record as an event, but the result is not as expected. Some records are displayed as individual events, but some are grouped into one event.

The result set looks like this:

1 5/26/10 9:19:21.000 AM FI.02-8947FI.02-8957FI.02-8979FI.03-8087FI.03-8171FI.03-8208FI.03-8270FI.03-8013FI.03-8278FI.03-8314 Show all 131 lines 2 5/26/10 9:19:20.000 AM FI.02-8886

3 5/26/10 9:19:20.000 AM FI.02-8877

4 5/26/10

9:19:20.000 AM FI.02-8865

Following below are the contents of props.conf file:

[host::imappl01dev] LINE_BREAKER = ([\r\n]+)

MAX_EVENTS = 1

Following below are the contents of inputs.conf file:

[default]

[monitor:///opt/applocal/sb1/utils/log/ADO_COUNT/*N0ADOs_to_be_Consolidated*] index = iss-rdr sourcetype = IntADOsNotConsolidated

[monitor:///opt/applocal/sb1/utils/log/ADO_COUNT/] index = iss-rdr sourcetype = IntADOsNotNormalized whitelist = /ADOsNotNormalized/?

Please help me to see each record as an individual event.

Thank you

Re: individual event: props.conf

Lowell — Wed, 26 May 2010 21:19:42 GMT

Your issues is with event breaking not line breaking. (You shouldn't have to mess with the LINE_BREAKER setting.)

I'm not sure if you assigned line numbers to your events of they are in the raw event data. If they are in the raw data, then it's possible that your it is confusing the date parser. So probably the best place to start is by setting up an explicit date format and telling splunk what junk to expect before the date. (The example given will match with or without the leading digit, so it should work either way.)

I would try setting the following in your props.conf file: (Note that I'm using the sourcetype of your events instead of creating a host:: matching stanza because that's generally a better approach, at least from my experience.)

[IntADOsNotConsolidated]
TIME_PREFIX = ^(?:\d+ +)?
# Date look like:   5/26/10 9:19:21.000 AM
TIME_FORMAT = %m/%d/%y %I:%M:%S.%3N %P
BREAK_ONLY_BEFORE_DATE = True

If your event are always exactly one line, then you can remove the BREAK_ONLY_BEFORE_DATE entry, and replace it with the following:

SHOULD_LINEMERGE = False

As with all settings like this, these changes to your props.conf file will only effect newly indexed data after a splunk restart.