https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319582#M95541 <P>the file usually starts with the text File version. I don't know what could I do if it doesn't have a specific pattern at the end in which I thought we need that to do an event break.</P> Wed, 06 Sep 2017 20:51:37 GMT tamduong16 2017-09-06T20:51:37Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319579#M95538 <P>I have a folder which contains multiple text files. I want to import these files into Splunk as events. which means each text file is 1 event. Each text file may have around 200 lines or less. Splunk seems to automatically split 1 text file to many events. What can I do to make Splunk recognize each file is an event? <BR /> *Note: each file could end with anythings, there is no specific ending pattern in the text file.</P> Wed, 06 Sep 2017 19:46:33 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319579#M95538 tamduong16 2017-09-06T19:46:33Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319580#M95539 <P>Does the text file start with a specific pattern? </P> <P>You can play around with combination of below properties</P> <P>BREAK_ONLY_BEFORE<BR /> TRUNCATE <BR /> SHOULD_LINEMERGE</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Propsconf" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Propsconf</A></P> Tue, 29 Sep 2020 15:39:57 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319580#M95539 pradeepkumarg 2020-09-29T15:39:57Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319581#M95540 <P>You can use BREAK_ONLY_BEFORE with an impossible string (well, relatively impossible) and it should look through the whole file without finding it and voila, you have a single file going into Splunk as a single event.</P> Tue, 29 Sep 2020 15:40:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319581#M95540 cpetterborg 2020-09-29T15:40:00Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319582#M95541 <P>the file usually starts with the text File version. I don't know what could I do if it doesn't have a specific pattern at the end in which I thought we need that to do an event break.</P> Wed, 06 Sep 2017 20:51:37 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319582#M95541 tamduong16 2017-09-06T20:51:37Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319583#M95542 <P>All of these settings need to be on your indexer. It will make no difference if you put them on your search head. </P> Wed, 06 Sep 2017 21:02:54 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319583#M95542 tmarlette 2017-09-06T21:02:54Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319584#M95543 <P>@cpetterborg: thank you so much. It's work. Is it ok if you post your answer below so I could accept it?</P> Wed, 06 Sep 2017 21:04:47 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319584#M95543 tamduong16 2017-09-06T21:04:47Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319585#M95544 <P>Here you go.</P> Wed, 06 Sep 2017 21:13:25 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-option-to-do-an-event-break-at-the-end-of-file-txt/m-p/319585#M95544 somesoni2 2017-09-06T21:13:25Z