Getting Data In

split each line as separate event

harishsundharam
New Member

I am getting disk space detail like below

root 13G 7.4G 4.1G 65% /
tmpfs 6.3G 0 6.3G 0% /dev/shm
sda1 500M 121M 353M 26% /boot
sdb1 43G 32G 8.8G 79% /data

But this has been showing in the single event, I want to get each line as a separate event with using linebreaker in PROS.conf.
Anyone help me to get this done

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider changing LINE_BREAKER to ([\r\n]*).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are your existing props.conf settings for that sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishsundharam
New Member

[ hdspace]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
MAX_TIMESTAMP_LOOKAHEAD=36
LINE_BREAKER=(\n\r)*

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...