Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Props.conf file changes
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
my sample data like this
101,Mango,0.40%
102,Orange,0.70%
It is coming as a single event, as i want to split into multiple events based on new line escape character.
What changes do i need to made in props.conf file
My sourcetype is "abc"
My props.conf looks like this
props.conf:
[abc]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
Anyone help me?
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That should do it. so check these:
The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That should do it. so check these:
The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Working now, I just restarted the splunkd service.
Thanks for your help!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
