Getting Data In

Props.conf file changes

prathapkcsc
Explorer

Hi,
my sample data like this
101,Mango,0.40%
102,Orange,0.70%
It is coming as a single event, as i want to split into multiple events based on new line escape character.
What changes do i need to made in props.conf file
My sourcetype is "abc"
My props.conf looks like this
props.conf:
[abc]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

Anyone help me?
Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

That should do it. so check these:

The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.

View solution in original post

0 Karma

woodcock
Esteemed Legend

That should do it. so check these:

The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.

0 Karma

prathapkcsc
Explorer

Working now, I just restarted the splunkd service.
Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...