Getting Data In
Highlighted

Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

New Member

Hi,

I have a forwarder on a Windows server that is pulling logs from a folder. Logs are in a single file (multiple lines - each line per event).
Each event for that index contains multiple lines in Splunk.
I would like Splunk to separate lines so each line appears as a new event.
Please help me achieve this. I want to extract fields, but to do it, I need to have each line as a separate event.

Right now events look like this:
alt text

0 Karma
Highlighted

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

SplunkTrust
SplunkTrust

What you need is to configure Line breaking for your log on Indexer/Heavy forwarder. Have a look at this to understand how splunk processes a log file data

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking

So, configure following on your indexer/Heavy forwarder

props.conf

[yoursourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)

View solution in original post

0 Karma
Highlighted

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

New Member

Thanks. I saw this document before. The issue is that there is no props.conf file in $SPLUNK_HOME/etc/system/local/
Our Splunk was initially configured by the consultant, that's why it's hard to make changes now.
I am pulling data with the deployment app I created. Should I create a props.conf file under the app itself?

0 Karma
Highlighted

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

Path Finder

Just create a new props.conf file with the desired configuration in $SPLUNK_HOME/etc/system/local/ on your indexer.

Make sure to restart Splunk to apply the changes.

0 Karma
Highlighted

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

Builder

Ideally you'll want to deploy as many changes as possible using the Deployment Server if you have one. But if you can't figure that out, than yes the changes mentioned above should get you where you need to go.

0 Karma
Highlighted

Re: Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event?

Ultra Champion

SHOULD_LINEMERGE = false in props.conf for the source, should do it.

0 Karma