Getting Data In
Highlighted

How to configure props.conf to index each log file in my directory as a single event?

Contributor

I have hundreds of logs in my directory. I need the entire data from each log to be represented as one event. May I know what settings I should use in props.conf to represent each log file as an single event?

0 Karma
Highlighted

Re: How to configure props.conf to index each log file in my directory as a single event?

Influencer

If you set sourcetype=syslog in your inputs.conf, you will not need to configure anything in props.conf. The syslog sourcetype ships with Splunk and will show each log line as one event.

If you are writing your own props.conf with a custom sourcetype, you can use the SHOULD_LINEMERGE=false parameter.

View solution in original post

0 Karma
Highlighted

Re: How to configure props.conf to index each log file in my directory as a single event?

Esteemed Legend

Put this in props.conf for your sourcetype on your indexers:

[YourSourcetypeHere]
LINE_BREAKER = SoMeThInG_ImPoSsIbLe_Here
TRUNCATE = 0
0 Karma