topic Re: How do I break into multiple events just by space? in Splunk Search

How do I break into multiple events just by space?

Kitteh — Tue, 29 Sep 2020 16:13:51 GMT

I want the one event in the picture to be broken into many events with the spaces in between. How do I do so with props.conf ?

Heres what i tried in my props.conf i tried "LINE_BREAKER = \s" and "LINE_BREAKER = [\s]"
[daemontest]
LINE_BREAKER = ([\s]+)
SHOULD_LINEMERGE = false

Re: How do I break into multiple events just by space?

jhigginsmq — Tue, 29 Sep 2020 16:13:54 GMT

"LINE_BREAKER = ([\s]+)" with "SHOULD_LINEMERGE=false" should work, and it works for me after mocking up a similar example and using the preview feature of "Add Data".

Are you sure those settings are being applied, i.e. are you restarting/refreshing Splunk after editing props.conf?

Re: How do I break into multiple events just by space?

s2_splunk — Thu, 12 Oct 2017 18:43:38 GMT

Are you configuring props.conf on the splunk instance that parses your event stream? That would be either your indexer, or a heavy forwarder you may have in your data ingest path.

Re: How do I break into multiple events just by space?

Kitteh — Fri, 13 Oct 2017 01:10:42 GMT

I am using universal forwarder

Re: How do I break into multiple events just by space?

Kitteh — Fri, 13 Oct 2017 01:17:15 GMT

Yes i've restart everytime i finished editing props.conf

Re: How do I break into multiple events just by space?

s2_splunk — Fri, 13 Oct 2017 01:47:55 GMT

Then your parsing settings need to go on the indexer as the UF does not do any event parsing.

Re: How do I break into multiple events just by space?

s2_splunk — Fri, 13 Oct 2017 01:49:02 GMT

See above, these settings have no effect on the UF, they need to go on the indexer, which is where the event parsing happens.
All the forwarder sees are 64KB chunks of data read from a monitored file or received on a network input.

Re: How do I break into multiple events just by space?

Kitteh — Tue, 29 Sep 2020 16:14:40 GMT

This has been fixed by adding the parameter "BREAK_ONLY_BEFORE=\s"

[daemontest]
LINE_BREAKER = ([\s]+)
BREAK_ONLY_BEFORE =\s
SHOULD_LINEMERGE = false

Above is my parameters used just by splitting events with space.