Getting Data In

props.conf how to break event after every new line?

Kitteh
Path Finder

As stated in the question, my props.conf has the following settings:

[daemonforCent]
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE=false

And as you can see, the result is still the same, not breaking anything. I've tried BREAK_ONLY_BEFORE=\r\n too but also will not work.

alt text

0 Karma

dantimola
Communicator

Was your problem resolved already? Please give me feedback as I'm having the same problem as well. Thank you.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Your props.conf is correct but these settings only apply at index time. You will need to be sure the props are on the forwarder(s) or indexer(s), and reingest any data that wasn’t properly ingested before.

Kitteh
Path Finder

they are done at the forwarders which worked well for ubuntu side with similar props settings.

0 Karma

MuS
SplunkTrust
SplunkTrust

Is this forwarders as in parsing heavy weight forwarders?

0 Karma

gcusello
Legend

Hi Kitteh,
let me understand: do you want to have a row in each event?
if yes use SHOULD_LINEMERGE = false

Bye.
Giuseppe

0 Karma

Kitteh
Path Finder

I want them to be separated into different event, so basically its just "abrtd (pid 2637)-running" as one event. So basically I suppose having rows do not matter as long events are splitted apart as its own.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...