Hello respective,
i have a CSV type file which contains multiple lines of data. when i upload into the splunk few line of data merged into a single event. i try to put few blank lines in between those lines, but still the lines are in a single event.
Ex. (csv file data)
First line in csv, first row, first word
Second line in csv, second row, second word
Third line in csv, third row, third word.
the above data i upload into splunk, then second and third line should one each single event, but it's coming in one event.
then i update the file.
Ex. (csv file data updated extra line in between lines)
First line in csv, first row, first word
Second line in csv, second row, second word
Third line in csv, third row, third word.
but still the result is same. it's not making 3 events, it's merging 2 lines to one event.
What are the props.conf settings for that sourcetype?
i am not sure, because it's done by the ADMIN's and i am only the user. can you please explain bit what need to be fixed in the .conf for this issue.
It's impossible to say what needs to be fixed without seeing what is there now. Please work with your admins.