Getting Data In

multirecord key/value input

New Member

I have a script that dumps data several lines at a time, each line has a set of key/value pairs eg:, port=8080, requests=234, heap=20485, port=8080, requests=104, heap=46225, uptime=24325, port=8080, requests=234

I want splunk to treat each line as a separate log entry and whatever keys are present to be collected (e.g. like the result you get with autoKV). How do I setup props.conf and transforms.conf?

0 Karma


you only need props.conf with the following:

# If your events has no timestamp the config below will add current date/time as timestamp
KV_MODE = auto
0 Karma