Previously the scripted inputs (source=cpu, source=netstat, etc) all created a single event per run. Recently however I noticed the openports (was probably that way for awhile) creates an event per line of output.
Why the differences? Just trying to understand the reason behind one vs. the other.
This is not new.
The props.conf config in older and current versions calls for a single line per event.
in unix app 4.6
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
REPORT-fields_for_cpu_sh = fields_for_cpu_sh
in unix app 5.0.0
`
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi
FIELDALIAS-dest_for_cpu = host as dest
FIELDALIAS-src_for_cpu = host as src
FIELDALIAS-cpu_for_cpu = CPU as cpu
FIELDALIAS-idle_time_for_cpu = pctIdle AS PercentIdleTime
FIELDALIAS-nice_time_for_cpu = pctNice AS PercentNiceTime
FIELDALIAS-cpu_load_percent_for_cpu = pctSystem AS PercentSystemTime,pctSystem as cpu_load_percent
FIELDALIAS-cpu_user_percent_for_cpu = pctUser AS PercentUserTime,pctUser as cpu_user_percent
FIELDALIAS-wait_time_for_cpu = pctIowait AS PercentWaitTime
`
This is not new.
The props.conf config in older and current versions calls for a single line per event.
in unix app 4.6
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
REPORT-fields_for_cpu_sh = fields_for_cpu_sh
in unix app 5.0.0
`
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi
FIELDALIAS-dest_for_cpu = host as dest
FIELDALIAS-src_for_cpu = host as src
FIELDALIAS-cpu_for_cpu = CPU as cpu
FIELDALIAS-idle_time_for_cpu = pctIdle AS PercentIdleTime
FIELDALIAS-nice_time_for_cpu = pctNice AS PercentNiceTime
FIELDALIAS-cpu_load_percent_for_cpu = pctSystem AS PercentSystemTime,pctSystem as cpu_load_percent
FIELDALIAS-cpu_user_percent_for_cpu = pctUser AS PercentUserTime,pctUser as cpu_user_percent
FIELDALIAS-wait_time_for_cpu = pctIowait AS PercentWaitTime
`
Though I've not updated to the TA for my *nix inputs yet, will roll that into my 6.0 upgrade.
Odd, source=cpu is still showing up as a single event for me. But the question was more "why the change", it kinda made sense to have one event as it's a snapshot in time, but yea always having to "| multikv" is a pain. Just trying to understand the reasoning, to mirror the functionality on my own inputs.