Getting Data In

How to upload and index a text file containing more than 1500 lines without any line breaks?

Path Finder

Hi

I would like to upload a text file containing more than 1500 lines without any line breaks. How do I do this in Splunk?

Here is my props.conf

[sourcetype]
MAX_EVENTS = 2000
TRUNCATE = 99999
SHOULD_LINEMERGE = TRUE
DATETIME_CONFIG = CURRENT

Even after making these changes, I am unable to get the data properly indexed in Splunk. I am getting line breaks. How do I properly get the events properly indexed to get the entire 1500 + lines as one event?

Please let me know.

Thanks

SplunkTrust
SplunkTrust

Try this. (props.conf on Indexer/Heavy Forwarder)

[sourcetype]
BREAK_ONLY_BEFORE = ^JUNKCHAR
DATETIME_CONFIG = CURRENT
MAX_EVENTS = 2000
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
TRUNCATE = 99999
0 Karma

Path Finder

Still I get only 704 lines indexed out of total of 1503 lines after applying the new props.conf on Indexer

0 Karma

Builder

I have this conf and it worked for me.

SHOULDLINEMERGE = true
BREAK
ONLYBEFORE = (ADFASDFA)
NOBINARYCHECK = true
MAXEVENT = 2000
is
valid = true
disabled = false
pulldown_type = true

Maybe there are something that you just don't need.

0 Karma