Getting Data In

How to create a props.conf for a app log?

sathiyasun
Explorer

how to create a props.conf for the below data..Need to break the line from ### endwith 

 

########################################

20220815.011001: =========================
20220815.011001: Cron dummy started by dummy1.
20220815.011001: =========================
20220815.011002: 20220815.011001: Checking processes on Prod SEATTLE server seat1
20220815.011001: 3 critical processes run on seat1
20220815.011001: 1 non-critical processes run on seat1
20220815.011001: 208 processes are now running on seat1
20220815.011001: 10 processes owned by dummy1
20220815.011001: SEATTLE Authentication_Process is running (581).
20220815.011001: SEATTLE is running (1709).
20220815.011001: PS Pmeter_Server is running (1886).
20220815.011002: PS Pmeter_Server is running (2000).
20220815.011002: All critical processes are running.
20220815.011002: =========================
20220815.011002: dummy complete.
20220815.011002: =========================
20220815.011501:

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sathiyasun,

you have a timestamp for each row, so you could also use this time stamp.

Anyway, as described at https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf you could use:

[your_sourcetype]
SHOULD_LINEMERGE = true
LINE_BREAKER = \d{8}\.\d{6}:\sCron\sdummy\sstarted\sby

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...