Splunk Enterprise

props.conf not working to break the events after pipe line

ashwinipatil007
New Member

i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.

HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP

tried with below 2 props.conf.

[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)

[sourcetype]
BREAK_ONLY_BEFORE = (|)

I am using splunk 7.0 version

Tags (1)
0 Karma

nickhills
Ultra Champion

Hi @ashwinipatil007

Try the following in your props.conf

[sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\|)

It wont hurt putting this on your UF, but it wont do anything. This needs to be on your indexers, or (heavy forwarders if you use them)

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Do you not have timestamps in any of your events?

If my comment helps, please give it a thumbs up!
0 Karma

ashwinipatil007
New Member

nope.
the props.conf are working fine when I try it before indexing the data but when I place them on HF (tried on UF as well) it is not breaking the events as expected.tried with below props.conf as well but no luck
I need to break the events before the PIPE in the above content.
any idea?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...