Getting Data In

how to line break snmp data

ahmedhassanean
Explorer

Dears,

i have configured scripted input that poll snmp of network devices using snmpwalk command but problem that walk come back to me as one events with 3000 line i would like to know how to break each line as event . please find below sample of output

IF-MIB::ifIndex.80 = 80
IF-MIB::ifIndex.736 = 736
IF-MIB::ifIndex.752 = 752
IF-MIB::ifIndex.768 = 768
IF-MIB::ifIndex.784 = 784
IF-MIB::ifIndex.800 = 800
IF-MIB::ifIndex.816 = 816
IF-MIB::ifIndex.832 = 832
IF-MIB::ifIndex.848 = 848
IF-MIB::ifIndex.864 = 864
IF-MIB::ifIndex.880 = 880
IF-MIB::ifIndex.928 = 928
IF-MIB::ifIndex.944 = 944
IF-MIB::ifIndex.960 = 960

0 Karma

DMohn
Motivator

If the events in your input are line separated, you should use the setting SHOULD_LINEMERGE = false in your props.conf (which normally defaults to true. This will split your input into one event per line.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...