I have a script that dumps data several lines at a time, each line has a set of key/value pairs eg:
server=host1.blah.net, port=8080, requests=234, heap=20485
server=host2.blah.net, port=8080, requests=104, heap=46225, uptime=24325
server=host3.blah.net, port=8080, requests=234
I want splunk to treat each line as a separate log entry and whatever keys are present to be collected (e.g. like the result you get with autoKV). How do I setup props.conf and transforms.conf?
you only need props.conf with the following:
[<yoursourcetype>]
SHOULD_LINEMERGE = False
# If your events has no timestamp the config below will add current date/time as timestamp
DATETIME_CONFIG = CURRENT
KV_MODE = auto