Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to merge multiple events into single events?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Splunkers,
I have one file whose starting line can be anything but that file ends with "Completed Backup" line. So currently the contents of the file are getting indexed line by line based on time. But I want the full content of the file from starting of file till "Completed Backup" in a single event.
I have checked LINE_BREAKER and SHOULD_LINEMERGE settings but didn't get the confidence on using these settings.
Please help me
Warm regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want the entire file content, regardless of how it starts, to a single events, you need to setup a LINE_BREAKER to something which will never be found on the log file.
Give this a try
[yourSourceType]
SHOULD_LINEMERGE =false
LINE_BREAKER = (MaryHadALittleLamb)
#Set below two attribute to values high enough to hold all your file content
TRUNCATE = 99999
MAX_EVENTS =1000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want the entire file content, regardless of how it starts, to a single events, you need to setup a LINE_BREAKER to something which will never be found on the log file.
Give this a try
[yourSourceType]
SHOULD_LINEMERGE =false
LINE_BREAKER = (MaryHadALittleLamb)
#Set below two attribute to values high enough to hold all your file content
TRUNCATE = 99999
MAX_EVENTS =1000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
where i need to mention in the UF props.conf or Indexer Props.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This should be in indexer or heavy forwarder, whichever comes fast.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@somesoni2 , where i need to mention in the UF props.conf or Indexer Props.conf
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
