topic Re: Adding data with oneshot on gemeric_single_line in Splunk Search

Adding data with oneshot on gemeric_single_line

nyp_kwyc — Mon, 28 Sep 2020 18:45:28 GMT

Currently using oneshot to index data into splunk (bash)
Is there a way to add a option for data to be in gemeric_single_line when using oneshot

Re: Adding data with oneshot on gemeric_single_line

aakwah — Fri, 30 Jan 2015 11:47:36 GMT

Could you please provide more clarification?

Regards,
Ahmed

Re: Adding data with oneshot on gemeric_single_line

nyp_kwyc — Mon, 02 Feb 2015 00:56:17 GMT

I created a bash script that include the oneshot command:
$SPLUNK add oneshot "$HOME/data.txt" -index myindex -hostname host1 -sourcetype datasource1

Then I realise my data log is all in one chunk - http://imgur.com/WD56m0y

Therefore I want to Event breaks at at every line when indexing the data via bash script command
Is there a augment for oneshot command to allow this option?

http://i.imgur.com/CAU3r5t.png

Re: Adding data with oneshot on gemeric_single_line

esix_splunk — Mon, 02 Feb 2015 14:37:29 GMT

If you want to do this, you'll need to define your own sourcetype via props and transforms. And then specify this sourcetype when you oneshot the data.