Getting Data In

props.conf how to break event after every new line?

Path Finder

As stated in the question, my props.conf has the following settings:

[daemonforCent]
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE=false

And as you can see, the result is still the same, not breaking anything. I've tried BREAK_ONLY_BEFORE=\r\n too but also will not work.

alt text

0 Karma

Communicator

Was your problem resolved already? Please give me feedback as I'm having the same problem as well. Thank you.

0 Karma

SplunkTrust
SplunkTrust

Your props.conf is correct but these settings only apply at index time. You will need to be sure the props are on the forwarder(s) or indexer(s), and reingest any data that wasn’t properly ingested before.

Path Finder

they are done at the forwarders which worked well for ubuntu side with similar props settings.

0 Karma

SplunkTrust
SplunkTrust

Is this forwarders as in parsing heavy weight forwarders?

0 Karma

SplunkTrust
SplunkTrust

Hi Kitteh,
let me understand: do you want to have a row in each event?
if yes use SHOULD_LINEMERGE = false

Bye.
Giuseppe

0 Karma

Path Finder

I want them to be separated into different event, so basically its just "abrtd (pid 2637)-running" as one event. So basically I suppose having rows do not matter as long events are splitted apart as its own.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!