Getting Data In

Searching a line from text file

shantanuo
Engager

I have a file with semi colon ; line breaks text file. It has been indexed in splunk.

 INSERT INTO `account` VALUES ('abc');
 INSERT INTO `account` VALUES ('xyz');
 INSERT INTO `account` VALUES ('pqr');
 INSERT INTO `account` VALUES ('mnp');

When I search for "pqr" it should show only 1 line. It is currently showing the next line "mnp" as well. There is no timestamp in the file and splunk still is grouping the lines by date-time. for e.g. all the lines mentioned above listed as a group under 06/09/2011 19:01:17.000

How do I return only one line while searching for 'pqr' ?

0 Karma
1 Solution

Ayn
Legend

You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.

You want to set SHOULD_LINEMERGE to "false" in props.conf (default is true). That way Splunk will not merge lines into combined events.

View solution in original post

Ayn
Legend

You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.

You want to set SHOULD_LINEMERGE to "false" in props.conf (default is true). That way Splunk will not merge lines into combined events.

Ayn
Legend

Sure, just define which source or sourcetype you want this setting to apply to in props.conf, e.g. for a source you would do

[source:///path/to/file]
SHOULD_LINEMERGE = false

or to do it on a sourcetype level,

[your_sourcetype]
SHOULD_LINEMERGE = false
0 Karma

shantanuo
Engager

Thanks, this is working. But I guess it will affect all the indexes. Is it possible to index only this file with semi colon ; as line_breaker ?

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...