Splunk Enterprise

How to include header from an event for splunk to recognize as the first line of the event log

Mo7860
New Member

I have a sample log, how do I create line breaking in props.conf on the indexers so that splunk can recognize the header (###) as the first line of the event message

 

sample log

 

########################################################################
Thu 05/02/2024 - 8:06:13.34
########################################################################
Parm-1 is XYZ
Parm-2 is w4567
Parm-3 is 3421
Parm-4 is mclfmkf
Properties file is jakjfdakohj
Parm-6 is %Source_File%
Parm-7 is binary
Parm-8 is
Parm-9 is
SOURCE_DIR is mfkljfdalkj
SOURCE_FILE is klnsaclkncalkn
FINAL_DIR is /mail/lslk/jdslkjd/
FINAL_FILE is lkjdflkj_*.txt
MFRAME is N

Version
(C) Copyright
*************************************************
Successfully connected

 

I want splunk to include the ### as the first line of the event message, but I am able to get line breaker from the second line Thu 05/02/2024 - 8:06:13.34

 

Please let me know

 

 

Labels (1)
0 Karma

marnall
Motivator

You should set the LINE_BREAKER field in your props.conf in your indexer machine(s). You can also set SHOULD_LINEMERGE = false to prevent Splunk from recombining the events.

[yoursourcetype]
LINE_BREAKER = ^()\#{72}\n[^\#]*\#{72}
SHOULD_LINEMERGE = false

Since your log header includes two lines of hashes, the REGEX should find both of them.

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...