Archive

Hi, Want to break event using line_breaker property.

shinde0509
Explorer

2017-04-02 22:45:19.023 -0600 so-splunky.local sshd[68061]: Accepted keyboard-interactive/pam for sowings from xx.xx.xx.xx port xx ssh2
2017-04-02 23:45:23.142 -0500 so-splunky.local sshd[68608]: Accepted keyboard-interactive/pam for sowings from xx.xx.xx.xx port xx ssh2

Tags (1)
0 Karma

woodcock
Esteemed Legend

Make sure that you are NOT setting SHOULD_LINEMERGE=true and keep the default (do not specify any LINE_BREAKER=).

0 Karma

cleelakrishna
New Member

in props.conf for particular stanza use this attribute , where which events you want to break

LINE_BREAKER = ([\r\n]+)

0 Karma

jimodonald
Contributor

It looks like a new line is the event breaker. Splunk should detect that on it's own, but you can try:

LINE_BREAKER = ([\r\n]+)

0 Karma