Getting Data In

how do I edit my props.conf to configure proper line breaking for my sample data?

Path Finder

I need help in creating props for the data input. The line should break after Block Output Operation 0.

Below is my props configured on the indexer:


TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N
TIME_PREFIX = Timestamp
MUST_BREAK_AFTER = Block Output Operations\s+\d+
MAX_EVENTS = 10000
KV_MODE = multi
category = Custom
disabled = false
pulldown_type = true

Below is my event indexed in Splunk:

Timestamp           07/13/2015 12:26:51 PM
      Page Faults                       0
      Page Reclaims                     62
      Page Swaps                        0
      Voluntary Context Switches        2
      Involuntary Context Switches      2
      Block Input Operations            0
      Block Output Operations           0

NOTE: The data set has 1 observations and 1 variables.
NOTE: DATA statement used (Total process time):
      real time           0.39 seconds
      user cpu time       0.00 seconds
      system cpu time     0.01 seconds
      memory              325.81k
      OS Memory           9508.00k

How do I eliminate the lines NOTE: to OS Memory from my event.

Please let me know.


Mohammed Mohiuddin

0 Karma

Esteemed Legend

This should work but you need to deploy it to your indexers (or Heavy Forwarders) and restart each Splunk instance before it will take effect. You might also look into sending the "NOTE" events into nullQueue; what you have done so far simply detaches them from the events you would like to keep but they still exist as their own separate events:

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!