I have a file with semi colon ; line breaks text file. It has been indexed in splunk.
INSERT INTO `account` VALUES ('abc');
INSERT INTO `account` VALUES ('xyz');
INSERT INTO `account` VALUES ('pqr');
INSERT INTO `account` VALUES ('mnp');
When I search for "pqr" it should show only 1 line. It is currently showing the next line "mnp" as well. There is no timestamp in the file and splunk still is grouping the lines by date-time. for e.g. all the lines mentioned above listed as a group under 06/09/2011 19:01:17.000
How do I return only one line while searching for 'pqr' ?
You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.
You want to set SHOULD_LINEMERGE
to "false" in props.conf
(default is true). That way Splunk will not merge lines into combined events.
You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.
You want to set SHOULD_LINEMERGE
to "false" in props.conf
(default is true). That way Splunk will not merge lines into combined events.
Sure, just define which source or sourcetype you want this setting to apply to in props.conf, e.g. for a source you would do
[source:///path/to/file]
SHOULD_LINEMERGE = false
or to do it on a sourcetype level,
[your_sourcetype]
SHOULD_LINEMERGE = false
Thanks, this is working. But I guess it will affect all the indexes. Is it possible to index only this file with semi colon ; as line_breaker ?