Getting Data In

Splunk incorrect default line breaking- What am I doing wrong?


Hello, I have a sourcetype that have a default LINE_BREAKING and SHOULD_LINEMERGE=false, like so:


Per my understanding, this mean it automatically extract each line as one event. But the indexed data is like this:

lnie break.PNGThe red event is correct with linecount=1, but most of the events have linecount=2, some have event more without line breaking. So what should I fix?

Labels (4)
0 Karma

Esteemed Legend

Hi @phamxuantung,

where did you located this props.conf?

it must be located on Indexers and (if present) on intermediate Heavy Forwarders, not on Universal Forwarders.



0 Karma


I setup for sourcetype in props.conf in my indexer with

LINE_BREAKER = ([\r\n]+)


But it still indexed with incorrect line break

0 Karma


This props.conf is in my /splunk/etc/apps/search/local and made in my search head (Setting -> Source types -> New Source type). We have a structure of 1 Master (and where we manage deployment apps) 1 search head and 4 indexer cluster. In most case, we create source type directly in our Search head. So you're telling me I should have setup props.conf in my indexer cluster for it to work correctly?

0 Karma

Path Finder

hi @phamxuantung LINE_BREAKER is applied during the Parsing Pipeline, so the instance with the LINE_BREAKER and SHOULD_LINEMERGE = false (merging pipeline) must be set on HF/Indexer level.

LINE_BREAKER on Search Heads would work if that Search Heads are directly indexing events (i.e. in Splunk all-in-one architectures), hence parsing events themself.

Hope this helps,


0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...