Getting Data In
Highlighted

split each line as separate event

New Member

I am getting disk space detail like below

root 13G 7.4G 4.1G 65% /
tmpfs 6.3G 0 6.3G 0% /dev/shm
sda1 500M 121M 353M 26% /boot
sdb1 43G 32G 8.8G 79% /data

But this has been showing in the single event, I want to get each line as a separate event with using linebreaker in PROS.conf.
Anyone help me to get this done

0 Karma
Highlighted

Re: split each line as separate event

SplunkTrust
SplunkTrust

What are your existing props.conf settings for that sourcetype?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: split each line as separate event

New Member

[ hdspace]
SHOULDLINEMERGE=false
NO
BINARYCHECK=true
MAX
TIMESTAMPLOOKAHEAD=36
LINE
BREAKER=(\n\r)*

0 Karma
Highlighted

Re: split each line as separate event

SplunkTrust
SplunkTrust

Consider changing LINE_BREAKER to ([\r\n]*).

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.