Hello Splunkers,
I have one file whose starting line can be anything but that file ends with "Completed Backup" line. So currently the contents of the file are getting indexed line by line based on time. But I want the full content of the file from starting of file till "Completed Backup" in a single event.
I have checked LINE_BREAKER and SHOULD_LINEMERGE settings but didn't get the confidence on using these settings.
Please help me
Warm regards
If you want the entire file content, regardless of how it starts, to a single events, you need to setup a LINE_BREAKER to something which will never be found on the log file.
Give this a try
[yourSourceType]
SHOULD_LINEMERGE =false
LINE_BREAKER = (MaryHadALittleLamb)
#Set below two attribute to values high enough to hold all your file content
TRUNCATE = 99999
MAX_EVENTS =1000
If you want the entire file content, regardless of how it starts, to a single events, you need to setup a LINE_BREAKER to something which will never be found on the log file.
Give this a try
[yourSourceType]
SHOULD_LINEMERGE =false
LINE_BREAKER = (MaryHadALittleLamb)
#Set below two attribute to values high enough to hold all your file content
TRUNCATE = 99999
MAX_EVENTS =1000
where i need to mention in the UF props.conf or Indexer Props.conf
This should be in indexer or heavy forwarder, whichever comes fast.
@somesoni2 , where i need to mention in the UF props.conf or Indexer Props.conf