Getting Data In

Splitting events every n characters

Motivator

Hi,

ist it possible to split events in a file based on a position? I have a file that has fixed width events of 200 chars and would like to index them as single events into Splunk.

Thanks

Chris

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can specify this in the sourcetype definition in props.conf:

LINE_BREAKER=.{200}()
SHOULD_LINEMERGE=0

View solution in original post

SplunkTrust
SplunkTrust

You can specify this in the sourcetype definition in props.conf:

LINE_BREAKER=.{200}()
SHOULD_LINEMERGE=0

View solution in original post