How to configure props.conf to index each log file in my directory as a single event?

[ankithreddy777]

I have hundreds of logs in my directory. I need the entire data from each log to be represented as one event. May I know what settings I should use in props.conf to represent each log file as an single event?

[woodcock]

Put this in props.conf for your sourcetype on your indexers:

[YourSourcetypeHere]
LINE_BREAKER = SoMeThInG_ImPoSsIbLe_Here
TRUNCATE = 0

[masonmorales · Accepted solution]

If you set sourcetype=syslog in your inputs.conf, you will not need to configure anything in props.conf. The syslog sourcetype ships with Splunk and will show each log line as one event.

If you are writing your own props.conf with a custom sourcetype, you can use the SHOULD_LINEMERGE=false parameter.