Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

[pashtet13]

Hi,

I have a forwarder on a Windows server that is pulling logs from a folder. Logs are in a single file (multiple lines - each line per event).
Each event for that index contains multiple lines in Splunk.
I would like Splunk to separate lines so each line appears as a new event.
Please help me achieve this. I want to extract fields, but to do it, I need to have each line as a separate event.

Right now events look like this:

[ddrillic]

SHOULD_LINEMERGE = false in props.conf for the source, should do it.

[somesoni2 · Accepted solution]

What you need is to configure Line breaking for your log on Indexer/Heavy forwarder. Have a look at this to understand how splunk processes a log file data

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking

So, configure following on your indexer/Heavy forwarder

props.conf

[yoursourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

[pashtet13]

Thanks. I saw this document before. The issue is that there is no props.conf file in $SPLUNK_HOME/etc/system/local/
Our Splunk was initially configured by the consultant, that's why it's hard to make changes now.
I am pulling data with the deployment app I created. Should I create a props.conf file under the app itself?

[aosso]

Just create a new props.conf file with the desired configuration in $SPLUNK_HOME/etc/system/local/ on your indexer.

Make sure to restart Splunk to apply the changes.

[ryanoconnor]

Ideally you'll want to deploy as many changes as possible using the Deployment Server if you have one. But if you can't figure that out, than yes the changes mentioned above should get you where you need to go.