Getting Data In

Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

pashtet13
New Member

Hi,

I have a forwarder on a Windows server that is pulling logs from a folder. Logs are in a single file (multiple lines - each line per event).
Each event for that index contains multiple lines in Splunk.
I would like Splunk to separate lines so each line appears as a new event.
Please help me achieve this. I want to extract fields, but to do it, I need to have each line as a separate event.

Right now events look like this:
alt text

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

What you need is to configure Line breaking for your log on Indexer/Heavy forwarder. Have a look at this to understand how splunk processes a log file data

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking

So, configure following on your indexer/Heavy forwarder

props.conf

[yoursourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

View solution in original post

0 Karma

ddrillic
Ultra Champion

SHOULD_LINEMERGE = false in props.conf for the source, should do it.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What you need is to configure Line breaking for your log on Indexer/Heavy forwarder. Have a look at this to understand how splunk processes a log file data

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking

So, configure following on your indexer/Heavy forwarder

props.conf

[yoursourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
0 Karma

pashtet13
New Member

Thanks. I saw this document before. The issue is that there is no props.conf file in $SPLUNK_HOME/etc/system/local/
Our Splunk was initially configured by the consultant, that's why it's hard to make changes now.
I am pulling data with the deployment app I created. Should I create a props.conf file under the app itself?

0 Karma

aosso
Path Finder

Just create a new props.conf file with the desired configuration in $SPLUNK_HOME/etc/system/local/ on your indexer.

Make sure to restart Splunk to apply the changes.

0 Karma

ryanoconnor
Builder

Ideally you'll want to deploy as many changes as possible using the Deployment Server if you have one. But if you can't figure that out, than yes the changes mentioned above should get you where you need to go.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...