topic Re: How to break events as Every Line in Splunk Search

How to break events as Every Line

dantimola — Mon, 10 Apr 2017 09:27:17 GMT

Hi All,

What's the appropriate regex for event break Every Line? Is my props.conf correct?

[index_name]
LINE_BREAKER = ([\r\n]+)

Re: How to break events as Every Line

asimagu — Mon, 10 Apr 2017 09:38:35 GMT

hi there, yes, that is correct.
However the stanza name should not be an index name but a sourcetype name.

Also, you could use
SHOULD_LINEMERGE = false

more info here: http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Propsconf

Re: How to break events as Every Line

gcusello — Mon, 10 Apr 2017 09:38:54 GMT

Hi dantimola
to have each event in one line use

SHOULD_LINEMERGE = false

I suggest, before logs indexing, try to index a test copy of your logs using the web extractor (inserting them in a test index), in this way, you can build your props.conf by web interface and see every configuration (timestamp, line break, etc...).
Bye.
Giuseppe