how do I edit my props.conf to configure proper line breaking for my sample data?

[OMohi]

I need help in creating props for the data input. The line should break after Block Output Operation 0.

Below is my props configured on the indexer:

[sourcetype]

[sas_input]
TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N
TIME_PREFIX = Timestamp
MAX_TIMESTAMP_LOOKAHEAD = 128
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = Block Output Operations\s+\d+
#BREAK_ONLY_BEFORE_DATE = false
MAX_EVENTS = 10000
KV_MODE = multi
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true

Below is my event indexed in Splunk:

Timestamp           07/13/2015 12:26:51 PM
      Page Faults                       0
      Page Reclaims                     62
      Page Swaps                        0
      Voluntary Context Switches        2
      Involuntary Context Switches      2
      Block Input Operations            0
      Block Output Operations           0

NOTE: The data set has 1 observations and 1 variables.
NOTE: DATA statement used (Total process time):
      real time           0.39 seconds
      user cpu time       0.00 seconds
      system cpu time     0.01 seconds
      memory              325.81k
      OS Memory           9508.00k

How do I eliminate the lines NOTE: to OS Memory from my event.

Please let me know.

Thanks,

Mohammed Mohiuddin

[woodcock]

This should work but you need to deploy it to your indexers (or Heavy Forwarders) and restart each Splunk instance before it will take effect. You might also look into sending the "NOTE" events into nullQueue; what you have done so far simply detaches them from the events you would like to keep but they still exist as their own separate events:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Routeandfilterdatad