Splunk Enterprise

props.conf not working to break the events after pipe line

ashwinipatil007
New Member

i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.

HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP

tried with below 2 props.conf.

[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)

[sourcetype]
BREAK_ONLY_BEFORE = (|)

I am using splunk 7.0 version

Tags (1)
0 Karma

nickhills
Ultra Champion

Hi @ashwinipatil007

Try the following in your props.conf

[sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\|)

It wont hurt putting this on your UF, but it wont do anything. This needs to be on your indexers, or (heavy forwarders if you use them)

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Do you not have timestamps in any of your events?

If my comment helps, please give it a thumbs up!
0 Karma

ashwinipatil007
New Member

nope.
the props.conf are working fine when I try it before indexing the data but when I place them on HF (tried on UF as well) it is not breaking the events as expected.tried with below props.conf as well but no luck
I need to break the events before the PIPE in the above content.
any idea?

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...