Hi Guys,
I'm trying to break events in Splunk with a text file with just ip addresss in it and no time stamps. The format is below:
1.1.1.1
1.2.3.4
192.168.1.2
How can I setup my props.conf file to break every line as a single event. I don't really care about timestamps.
You can set the following in your props.conf for the sourcetype:
[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
HTH,
Dave
You can set the following in your props.conf for the sourcetype:
[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
HTH,
Dave
Thanks this worked great!!