i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.
HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP
tried with below 2 props.conf.
[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)
[sourcetype]
BREAK_ONLY_BEFORE = (|)
I am using splunk 7.0 version
Hi @ashwinipatil007
Try the following in your props.conf
[sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\|)
It wont hurt putting this on your UF, but it wont do anything. This needs to be on your indexers, or (heavy forwarders if you use them)
Do you not have timestamps in any of your events?
nope.
the props.conf are working fine when I try it before indexing the data but when I place them on HF (tried on UF as well) it is not breaking the events as expected.tried with below props.conf as well but no luck
I need to break the events before the PIPE in the above content.
any idea?