Getting Data In

Splunk incorrect default line breaking- What am I doing wrong?

phamxuantung
Communicator

Hello, I have a sourcetype that have a default LINE_BREAKING and SHOULD_LINEMERGE=false, like so:

phamxuantung_0-1677818696153.png

Per my understanding, this mean it automatically extract each line as one event. But the indexed data is like this:

lnie break.PNGThe red event is correct with linecount=1, but most of the events have linecount=2, some have event more without line breaking. So what should I fix?

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phamxuantung,

where did you located this props.conf?

it must be located on Indexers and (if present) on intermediate Heavy Forwarders, not on Universal Forwarders.

Ciao.

Giuseppe

0 Karma

phamxuantung
Communicator

I setup for sourcetype in props.conf in my indexer with

LINE_BREAKER = ([\r\n]+)

SHOULD_LINEMERGE = false

But it still indexed with incorrect line break

0 Karma

phamxuantung
Communicator

This props.conf is in my /splunk/etc/apps/search/local and made in my search head (Setting -> Source types -> New Source type). We have a structure of 1 Master (and where we manage deployment apps) 1 search head and 4 indexer cluster. In most case, we create source type directly in our Search head. So you're telling me I should have setup props.conf in my indexer cluster for it to work correctly?

0 Karma

LRF
Path Finder

hi @phamxuantung LINE_BREAKER is applied during the Parsing Pipeline, so the instance with the LINE_BREAKER and SHOULD_LINEMERGE = false (merging pipeline) must be set on HF/Indexer level.

LINE_BREAKER on Search Heads would work if that Search Heads are directly indexing events (i.e. in Splunk all-in-one architectures), hence parsing events themself.

Hope this helps,

Fabrizio

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...