I have hundreds of logs in my directory. I need the entire data from each log to be represented as one event. May I know what settings I should use in props.conf to represent each log file as an single event?
If you set sourcetype=syslog in your inputs.conf, you will not need to configure anything in props.conf. The syslog sourcetype ships with Splunk and will show each log line as one event.
If you are writing your own props.conf with a custom sourcetype, you can use the SHOULD_LINEMERGE=false parameter.
View solution in original post
Put this in props.conf for your sourcetype on your indexers:
LINE_BREAKER = SoMeThInG_ImPoSsIbLe_Here
TRUNCATE = 0