Getting Data In

Searching a line from text file

Engager

I have a file with semi colon ; line breaks text file. It has been indexed in splunk.

 INSERT INTO `account` VALUES ('abc');
 INSERT INTO `account` VALUES ('xyz');
 INSERT INTO `account` VALUES ('pqr');
 INSERT INTO `account` VALUES ('mnp');

When I search for "pqr" it should show only 1 line. It is currently showing the next line "mnp" as well. There is no timestamp in the file and splunk still is grouping the lines by date-time. for e.g. all the lines mentioned above listed as a group under 06/09/2011 19:01:17.000

How do I return only one line while searching for 'pqr' ?

0 Karma
1 Solution

Legend

You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.

You want to set SHOULD_LINEMERGE to "false" in props.conf (default is true). That way Splunk will not merge lines into combined events.

View solution in original post

Legend

You should tell Splunk how to break the lines in the file into individual events. By default Splunk creates a new event whenever it sees a timestamp. If your file looks exactly like you pasted I'm a bit surprised you're only getting two lines in one event - there should be even more.

You want to set SHOULD_LINEMERGE to "false" in props.conf (default is true). That way Splunk will not merge lines into combined events.

View solution in original post

Legend

Sure, just define which source or sourcetype you want this setting to apply to in props.conf, e.g. for a source you would do

[source:///path/to/file]
SHOULD_LINEMERGE = false

or to do it on a sourcetype level,

[your_sourcetype]
SHOULD_LINEMERGE = false
0 Karma

Engager

Thanks, this is working. But I guess it will affect all the indexes. Is it possible to index only this file with semi colon ; as line_breaker ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!