Our syslog data in Splunk is showing up with at least 1% of the results with incorrect line breaking.
We have tried to update many settings in props.conf (in the master-apps directory) below:
We are using a Universal Forwarder.
Thanks for the suggestion. Unfortunately, I'm still getting line break issues where I do have some lines that are listed as separate events, but should be part of the previous event and do not have a timestamp. Any other suggestions?
So your syslog data is not 1 line per event. Try this in props.conf.
Also, make sure that your settings are not being overridden by settings in other props.conf files (like SPLUNK_HOME/etc/system/local)
Are you sure that your timestamp format is correct? I also bumped up the lookahead for the timestamp a little bit. Again, check spelling carefully and remember that almost everything in IS case-sensitive.