Getting Data In

monitor records several lines in one _raw

jrodriguezap
Contributor

Hello
I have a file with 30 lines that want to register in Splunk.
After you have configured the inputs.conf the splunk _raw saved one, with all lines of the file, when they should be 30 _raw
This is my configuration inputs.conf
I will be failing in something?

[monitor:///var/log/splunk/data_clientes.log] 
index = main 
source = txt 
host = SIEM 
SourceType = customers 
disabled = false
0 Karma

Ayn
Legend

This doesn't have anything to do with what you configure in inputs.conf, rather it's related to how Splunk is breaking data into events. For more information, read here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Indexmulti-lineevents

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...