Splunk Enterprise

props.conf not working to break the events after pipe line

ashwinipatil007
New Member

i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.

HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP

tried with below 2 props.conf.

[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)

[sourcetype]
BREAK_ONLY_BEFORE = (|)

I am using splunk 7.0 version

Tags (1)
0 Karma

nickhills
Ultra Champion

Hi @ashwinipatil007

Try the following in your props.conf

[sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\|)

It wont hurt putting this on your UF, but it wont do anything. This needs to be on your indexers, or (heavy forwarders if you use them)

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Do you not have timestamps in any of your events?

If my comment helps, please give it a thumbs up!
0 Karma

ashwinipatil007
New Member

nope.
the props.conf are working fine when I try it before indexing the data but when I place them on HF (tried on UF as well) it is not breaking the events as expected.tried with below props.conf as well but no luck
I need to break the events before the PIPE in the above content.
any idea?

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...