Monitoring Splunk

How to set SHOULD_LINEMERGE = false as default when using monitor to upload data?

yunieyuna
New Member

Hi, I need to upload a bunch of logs into Splunk by using monitor directory function.
But the data will be merged together if the "SHOULD_LINEMERGE" set to "true". I already known how to set it when uploading one file, but not using "monitor.

Can any one please help me?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Do not use the GUI for onboarding new data. Use the CLI and create an app with the settings that you need in the default folder.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

In this case create new unique sourcetype and assign it to monitor stanza and on Indexer/Heavy Forwarder implement below config.

props.conf

[yourSourcetype]
SHOULD_LINEMERGE = false
0 Karma

yunieyuna
New Member

Hello Harsmarvania57,

Thank you so much for your answer!

Actually, I ran into another problem when I tried to create a new sourcetype.
I set SHOULD_LINEMERGE = false under the Advanced tab. However, every time I clicked Save button, the setting will automatically changed to "true". And the same situation happens again and again.

I added two screenshots as references.

Goal: ![alt text][https://ibb.co/0n5ngG3]
However: ![alt text][https://ibb.co/b1h5zjM]

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

As @woodcock suggested, it will be good to use CLI instead of GUI. Most of the work I do on CLI instead of GUI.

0 Karma

pir8radio
Path Finder

Then please include instructions how to do that in windows splunk.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...