Getting Data In
Highlighted

Configuration of props.conf and input.conf

Builder

Hi
I am interested to upload two distinct files form multiple directories. I have done this previously by using Splunk-web, but now I am trying to do it by modifying props.conf and input.conf. So I have two files that have two different extension. So I believe my input.conf goes like this

[monitor://C:/User/.../Data/...]
index = myindex1
sourcetype = my
sourcetype1
whitelist = .tir$
initCrcLength = 4000

[monitor://C:/User/.../Data/...]
index = myindex2
sourcetype = my
sourcetype2
whitelist = .JobEvent$
initCrcLength = 4000

Both sourcetype are custom. The events are very long. I am no sure if I'm starting the stanza correctly with the sourcetype. Please let me know I if this look right.

[mysourcetype1]
SHOULD
LINEMERGER = true
NOBINARYCHECK = true
disabled = false
pulldowntype = true
category = Custom
MAX
EVENTS = 100000
BREAKONLYBEFORE = Massabeeldiabloporviejoquepordiablo

[mysourcetype2]
SHOULD
LINEMERGER = true
NOBINARYCHECK = true
disabled = false
pulldowntype = true
category = Custom
MAX
EVENTS = 100000
BREAKONLYBEFORE = Massabeeldiabloporviejoquepordiablo

0 Karma
Highlighted

Re: Configuration of props.conf and input.conf

Esteemed Legend

IMHO, this should work but you may still find events broken/terminated/truncated due to other limits; see here:
http://answers.splunk.com/answers/4162/size-limit-for-an-event.html

View solution in original post

0 Karma
Highlighted

Re: Configuration of props.conf and input.conf

Builder

For now I cannot do much about those long files. In the future my plan is to parse all those files and create new files with a different structure/format that would be easier to divide them in multiple events, but that's another project. Thanks for your response.

0 Karma