Splitting events every n characters

[chris]

Hi,

ist it possible to split events in a file based on a position? I have a file that has fixed width events of 200 chars and would like to index them as single events into Splunk.

Thanks

Chris

[martin_mueller · Accepted solution]

You can specify this in the sourcetype definition in props.conf:

LINE_BREAKER=.{200}()
SHOULD_LINEMERGE=0