Do line breaking configs in props.conf apply to files that are manually uploaded to Splunk?

[jambajuice]

I have a very simple config for an input in props.conf:

[fortinet_config]
SHOULD_LINEMERGE = True

If I use the "Upload a local file" option to index a config file, Splunk always breaks it up into individual lines.

Are stanzas in props.conf applied to files that are uploaded through the GUI?

Thx.

Craig

[Ron_Naken]

They do apply to uploaded files. Here's a props.conf trick that's used by the *NIX app to consume long outputs as a single entry. A stanza like the following will allow you to consume your entire config file as a single event. Be sure to manually set your sourcetype on the Data Input to whatever you use in your stanza (myconfigs in the example):

[myconfigs]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000

[gkanapathy]

Yes, you should specify the sourcetype when uploading (unless your props.conf rules are based on source...but you have to be careful here, as the file path will be the path of the batch directory). Also, a less risky LINE_BREAKER would be (?!), which will never match. ^()$ will work in this context, but that regex will not always fail.

[jrodman]

They should apply, and if they do not (and have that sourcetype), that is a bug.

That configuration is not terribly extensive, so I'm uncertain what differences you are seeing. There could be a more complex case where the behavior relies on certain source:: based rules, which aren't matching for the upload behavior.