Hello! Sorry for my bad english.
My props.conf file:
[testudp]
SHOULD_LINEMERGE = false
I have several json objects (each on its own line) merged into one event. Best of problem is shown in the screenshots:
I tried some other tweaks found here, but nothing happens. I hope very much for your help. Thanks in advance.
Sorry for passive links, limitations for new user.
Hi Paulelms, can you tell me if it's showing Sourcetype=testudp on your events, if not, please re-configure your UDP input with the following settings;
After doing the above, it should recognise the sourcetype being testudp and then will implement the SHOULD_LINEMERGE attribute.
Hi Paulelms, can you tell me if it's showing Sourcetype=testudp on your events, if not, please re-configure your UDP input with the following settings;
After doing the above, it should recognise the sourcetype being testudp and then will implement the SHOULD_LINEMERGE attribute.
Screen: http://take.ms/t6rGN
Ok, so restart your splunk instance, and then go to New UDP input, and select from the SOURCETYPE dropdown, the testUDP sourcetype, not the source.
Hope this helps
Thanks Sir!!!
No problem