topic Re: Help with props.conf changes in Splunk Search

Help with props.conf changes

vrmandadi — Thu, 18 Feb 2016 17:37:27 GMT

link textHello Experts,

Attached is the sample JSON file which I am trying to upload to Splunk.I have uploaded it by Splunk WEB and it broke the events successfully but when I am trying to upload via CLI it is taking all 8 events into a single event.Can you please help how to break those events(8).

Re: Help with props.conf changes

gyslainlatsa — Thu, 18 Feb 2016 17:46:41 GMT

what version SPLUNK that use?

Re: Help with props.conf changes

somesoni2 — Thu, 18 Feb 2016 17:55:00 GMT

Are you using the correct time-range ( check the timestamp of the events in your file)? What is the retention period of the new index you created and are timestamp of events in your file older than the retention period?

Re: Help with props.conf changes

vrmandadi — Thu, 18 Feb 2016 17:57:16 GMT

version 6.2.3

Re: Help with props.conf changes

vrmandadi — Thu, 18 Feb 2016 17:58:58 GMT

I have selected the time stamp as auto, when tried using CLI it is taking the file but it is not breaking into events..so can we use the same props from splunk web in the CLI props file

Re: Help with props.conf changes

gyslainlatsa — Thu, 18 Feb 2016 18:06:32 GMT

did you select the indexes when loading the file?
if so, try to post me a sample of your data here, I also try to indexing.

Re: Help with props.conf changes

ngatchasandra — Tue, 23 Feb 2016 10:47:47 GMT

Hi vrmandadi,

Try to verify if your role have not the search restrictions and see explanation to monitor this by follow the link:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles

Re: Help with props.conf changes

vrmandadi — Tue, 23 Feb 2016 17:32:44 GMT

hello ngatchasandra,

The problem is not with roles or permissions it is with the props configurations which need to be done

Re: Help with props.conf changes

vrmandadi — Tue, 23 Feb 2016 17:35:21 GMT

Hello somesh,

I am new to splunk what exactly does retention period mean?

Re: Help with props.conf changes

vrmandadi — Tue, 23 Feb 2016 20:49:52 GMT

I have attached the sample file,can you please try and let me know the props configuration in CLI..Thanks

Re: Help with props.conf changes

somesoni2 — Tue, 23 Feb 2016 21:22:36 GMT

Hey Vineeth,

Please ignore my comments, seems like I posted my comments of some other post here.

You said you're able to successfully update and break events from Splunk Web. so you must've selected some sourcetype for it. Did you use the same sourcetype when you tried to upload it from CLI?? I'm guessing you used splunk add oneshot method.

Re: Help with props.conf changes

somesoni2 — Tue, 29 Sep 2020 08:54:02 GMT

You can use this for your sourcetype definition in props.conf (on Indexer/Heavy forwarder). Do remember to restart/reload splunk instance after making this change.

[ YourSourceType ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
LINE_BREAKER=([\r\n]+)\{\"TRL_ID
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%N %z
TIME_PREFIX=TRL_DATETIME_LOCAL_TXN\":\"
MAX_TIMESTAMP_LOOKAHEAD=30

I've used TRL_DATETIME_LOCAL_TXN as the event timestamp field. Change as per your requirement.

Once you've this setup, you can upload a file from CLI like this

splunk add oneshot fullpathtothefiletobeuploaded -index nameofindex -sourcetype sourcetypecreatedabove

Re: Help with props.conf changes

vrmandadi — Wed, 24 Feb 2016 04:42:20 GMT

Somesh Thank You so much will try this and let you know