Line breaks and the 'Add Data' process

[_smp_]

I'm a fairly inexperience Splunk admin, and I've used the Add Data feature a couple of times to test out new sourcetype properties. At the moment, I'm trying to develop a custom syslog sourcetype and apply it to a network input but I'm having a lot of difficulty with line breaking. The sample data I'm using was gathered by a packet capture, exported as raw data, and added to a text file. It seem to get it working with the sample data, but when I apply it to the actual input, I run into all sorts of issues.

This got me thinking...the syslog events in the input stream do not actually end with a CR/LF character. But every event my sample data that I'm ingesting is on a new line. Is this an inaccurate way to represent the sample data? Would it be a more accurate representation of the input stream if I concatenated these test events onto a single line in my sample text file and tried to line-break from there?

[woodcock]

The "right" way to do this is to use the Stream app for Splunk to do the packet capture and you will be blown away. Is there some reason that you cannot do this?

[_smp_]

No, just inexperience. I am reading the documentation now.

[woodcock]

https://docs.splunk.com/Documentation/StreamApp/7.0.1/DeployStreamApp/AboutSplunkAppforStream

[_smp_]

I have spent the last four hours trying to make sense of this app, but it is just way too far over my head at my current experience level. Hopefully someone will respond with an alternate approach.

[woodcock]

You install the splunkstreamfwd.tgz app on your forwarder, set your ethernet adapter to promiscuous mode and you should have data coming in.