Getting Data In

Props.conf file changes

prathapkcsc
Explorer

Hi,
my sample data like this
101,Mango,0.40%
102,Orange,0.70%
It is coming as a single event, as i want to split into multiple events based on new line escape character.
What changes do i need to made in props.conf file
My sourcetype is "abc"
My props.conf looks like this
props.conf:
[abc]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

Anyone help me?
Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

That should do it. so check these:

The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.

View solution in original post

0 Karma

woodcock
Esteemed Legend

That should do it. so check these:

The props.conf file is deployed to your indexing servers (usually Indexers, occasionally Heavy Forwarders).
Ensure that there are no competing entries for your sourcetype ( $SPLUNK_HOME/bin/splunk cmd btool props list abc ).
Ensure that the sourcetype values match EXACTLY (case matters).
Restart all splunk instances after the file is deployed.
When you test/evaluate your change, check ONLY events that have been forwarded after the restarts (older/previous events will stay broken); you can use _index_earliest=-5m or similar to ensure this.

0 Karma

prathapkcsc
Explorer

Working now, I just restarted the splunkd service.
Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...