- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Props.conf file changes
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
my sample data like this
101,Mango,0.40%
102,Orange,0.70%
It is coming as a single event, as i want to split into multiple events based on new line escape character.
What changes do i need to made in props.conf file
My sourcetype is "abc"
My props.conf looks like this
props.conf:
[abc]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
Anyone help me?
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That should do it. so check these:
The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That should do it. so check these:
The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Working now, I just restarted the splunkd service.
Thanks for your help!
Fueling your curiosity with new Splunk ILT and eLearning courses
Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...
Unleash Unified Security and Observability with Splunk Cloud Platform
