Getting Data In

lines not breaking in old (rolled) log files

mmattek
Path Finder

so I have a case where my line breaks are fine in the Director.log

but in Director.log.20100517 00-20-29##20.log

they don't get applied.

What's interesting is the get the right source type from the props.conf (in the deployed app)

[source::...Director.log...]
sourcetype = rs_director

and that stanza should take care of it..
the in props.conf of the local app on the indexer, i have this:

[rs_director]
BREAK_ONLY_BEFORE=^\d+-\d+-\d+\s+\d+:\d+:\d+.\d+:
pulldown_type = true
AUTO_TAG = false
KV_MODE = none
MAX_TIMESTAMP_LOOKAHEAD = 25
MAX_EVENTS = 512
AUTO_LINEMERGE = false
TIME_FORMAT = %m-%d-%y %H:%M:%S
TZ = EST-5EDT,M3.2.0,M11.1.0

but it doesn't break the old logs (the regex works fine in the base log)..

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

If your events are single line
Try SHOULD_LINEMERGE = false
instead of AUTO_LINEMERGE

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...