{"alarm": {"attribute": [{"@id": "0x10000", "$": "SwCiscoIOS"}, {"@id": "0x11d42", "$": "tfotaprdhkap002"}, {"@id": "0x12022", "$": "0"}, {"@id": "0x12c05", "$": "Directly Managed"}, {"@id": "0x13345", "$": "0"}, {"@id": "0x12a07", "$": "0"}, {"@id": "0x12a06", "$": "0"}, {"@id": "0x1000a", "$": "2"}, {"@id": "0x11f4d", "$": "false"}, {"@id": "0x12b4c", "$": "AGENT SNMP NOT RESPONDING TO POLLS"}, {"@id": "0x11f4e", "$": "1568288097"}, {"@id": "0x1006e", "$": "sacctok0602.jp.world.socgen"}, {"@id": "0x11f50", "$": "67329"}, {"@id": "0x11f57", "$": "true"}, {"@id": "0x11f56", "$": "2"}, {"@id": "0x11f9b", "$": "false"}, {"@id": "0x129fa", "$": "0x92833e"}, {"@id": "0x11f9c", "$": "5d7a2d61-f9ca-1567-035e-00801005f81c"}, {"@id": "0x12d7f", "$": "176.3.250.18"}], "@id": "5d7a2d61-f9ca-1567-035e-00801005f81c"}, "@preexisting": false}, {"alarm": {"attribute": [{"@id": "0x10000", "$": "SwCiscoIOS"}, {"@id": "0x11d42", "$": "psehlx20"}, {"@id": "0x12022", "$": "0"}, {"@id": "0x12c05", "$": "Directly Managed"}, {"@id": "0x13345", "$": "0"}, {"@id": "0x12a07", "$": "0"}, {"@id": "0x12a06", "$": "0"}, {"@id": "0x1000a", "$": "0"}, {"@id": "0x11f4d", "$": "false"}, {"@id": "0x12b4c", "$": "TRAP LINK DOWN IS RECEIVED"}, {"@id": "0x11f4e", "$": "1568288101"}, {"@id": "0x1006e", "$": "PDC-SW-N47_01.eu.newedge.int"}, {"@id": "0x11f50", "$": "2228225"}, {"@id": "0x11f57", "$": "true"}, {"@id": "0x11f56", "$": "1"}, {"@id": "0x11f9b", "$": "true"}, {"@id": "0x129fa", "$": "0x1b30db"}, {"@id": "0x11f9c", "$": "5d7a2d65-d81a-1dba-031e-008010400a87"}, {"@id": "0x12d7f", "$": "195.118.1.40"}], "@id": "5d7a2d65-d81a-1dba-031e-008010400a87"}, "@preexisting": false},
it should break at {"alarm":
Hi surekhasplunk,
what's your architecture: have you an Heavy Forwarder or not?
where do you locate the props.conf?
props.conf must be located on Indexers and (if present) on Heavy Forwarders.
Bye.
Giuseppe
What are the current props.conf settings for this sourcetype?
Have you tried LINE_BREAKER = (){"alarm":
?
yes line break is happening but taking only 1 event not all