Getting Data In

multirecord key/value input

deusaquilus
New Member

I have a script that dumps data several lines at a time, each line has a set of key/value pairs eg:

server=host1.blah.net, port=8080, requests=234, heap=20485
server=host2.blah.net, port=8080, requests=104, heap=46225, uptime=24325
server=host3.blah.net, port=8080, requests=234

I want splunk to treat each line as a separate log entry and whatever keys are present to be collected (e.g. like the result you get with autoKV). How do I setup props.conf and transforms.conf?

0 Karma

MarioM
Motivator

you only need props.conf with the following:

[<yoursourcetype>]
SHOULD_LINEMERGE = False 
# If your events has no timestamp the config below will add current date/time as timestamp
DATETIME_CONFIG = CURRENT
KV_MODE = auto
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...