Getting Data In

Forwarders windwos log

kulo
Engager

I have a windows log forwarded to the splunk via Forwarders, and I want Forwarder to read to the splunk line by line. What should I do?

The following is my log format:
xxx.log
xxxxxxxxxxxx
xxxxxxxxxxxx
xxxxxxxxxxxx

There is only one line of text per line, no timestamp

0 Karma

HiroshiSatoh
Champion

I think that it can be read with the default setting.

If the character code is other than UTF - 8, please set it in props.conf.

<Configure event line breaking> line breaking⇒CRLF
http://docs.splunk.com/Documentation/Splunk/6.6.1/Data/Configureeventlinebreaking

<How timestamp assignment works> timestamp⇒Current time
http://docs.splunk.com/Documentation/Splunk/6.6.1/Data/HowSplunkextractstimestamps

0 Karma

kulo
Engager

Thanks, Can you give me props.conf standard configuration, I do not take effect in accordance with the document profile。
My props.conf file location is located in etc/apps/search/default/props.conf

[source::D:\test*.log]
LINE_BREAKER_LOOKBEHIND=100
BARAK_ONLY_BEFORE_DATE = False
MAX_EVENTS = 1

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...