Getting Data In

Line breaks per single line for IP address

tbalouch
Path Finder

Hi Guys,

I'm trying to break events in Splunk with a text file with just ip addresss in it and no time stamps. The format is below:

1.1.1.1
1.2.3.4
192.168.1.2

How can I setup my props.conf file to break every line as a single event. I don't really care about timestamps.

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

You can set the following in your props.conf for the sourcetype:

[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

HTH,

Dave

View solution in original post

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You can set the following in your props.conf for the sourcetype:

[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

HTH,

Dave

0 Karma

tbalouch
Path Finder

Thanks this worked great!!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>