Getting Data In

split each line as separate event

harishsundharam
New Member

I am getting disk space detail like below

root 13G 7.4G 4.1G 65% /
tmpfs 6.3G 0 6.3G 0% /dev/shm
sda1 500M 121M 353M 26% /boot
sdb1 43G 32G 8.8G 79% /data

But this has been showing in the single event, I want to get each line as a separate event with using linebreaker in PROS.conf.
Anyone help me to get this done

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider changing LINE_BREAKER to ([\r\n]*).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are your existing props.conf settings for that sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishsundharam
New Member

[ hdspace]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
MAX_TIMESTAMP_LOOKAHEAD=36
LINE_BREAKER=(\n\r)*

0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...