i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) befo...
See more...
i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.
HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP
tried with below 2 props.conf.
[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)
[sourcetype]
BREAK_ONLY_BEFORE = (|)
I am using splunk 7.0 version