Getting Data In

How to configure props.conf to index each log file in my directory as a single event?

ankithreddy777
Contributor

I have hundreds of logs in my directory. I need the entire data from each log to be represented as one event. May I know what settings I should use in props.conf to represent each log file as an single event?

0 Karma
1 Solution

masonmorales
Influencer

If you set sourcetype=syslog in your inputs.conf, you will not need to configure anything in props.conf. The syslog sourcetype ships with Splunk and will show each log line as one event.

If you are writing your own props.conf with a custom sourcetype, you can use the SHOULD_LINEMERGE=false parameter.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Put this in props.conf for your sourcetype on your indexers:

[YourSourcetypeHere]
LINE_BREAKER = SoMeThInG_ImPoSsIbLe_Here
TRUNCATE = 0
0 Karma

masonmorales
Influencer

If you set sourcetype=syslog in your inputs.conf, you will not need to configure anything in props.conf. The syslog sourcetype ships with Splunk and will show each log line as one event.

If you are writing your own props.conf with a custom sourcetype, you can use the SHOULD_LINEMERGE=false parameter.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...