line breaker event breaker

[ryanaa]

當我在SH設置好props.conf後去看我的uf端並重啟就會出現以下錯誤:

Checking conf files for problems...
Invalid key in stanza [web:access] in /opt/splunkforwarder/etc/apps/dynasafe_course_demo_ta/local/props.conf, line 3: ENVENT_BREAKER (value: ([\r\n]+)).
Invalid key in stanza [web:secure] in /opt/splunkforwarder/etc/apps/dynasafe_course_demo_ta/local/props.conf, line 6: ENVENT_BREAKER (value: ([\r\n]+)).
Your indexes and inputs configurations are not internally consistent.
這是怎麼回事

[kiran_panchavat · Accepted solution]

@ryanaa Line breaking is not possible with the universal forwarder.  The indexer or HF is responsible for that.

The EVENT_BREAKER setting is the only one that functions with UF; nevertheless, it simply instructs UF to identify the boundaries of events and causes it to deliver whole events to indexers.

Try to apply this settings on an heavy forwarder or indexer.

If this reply helps you an upvote and "Accept as Solution" is appreciated.