I have the same issue. Is their a solution for this problem!? ... View more

Out of interest, is the _cluster directory there for some special system reason ? We distribute indexes.conf and parsing apps for the indexers by putting them in apps under master-apps and we've never done anything with the files under _cluster. You recommend putting configs in _cluster (in here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_configuration_bundle), rather than appifying/containerizing all configs as per your normal best practice ? It strikes me as something you (Splunk) are likely to update as you release new versions and add indexes (for example, _telemetry). I'd call this a system directory, not a user manageable directory. Soooo...I was just wondering why it's there. ... View more

Thanks for your answer, but I can't use the complete phrase as line breaker because the words are changing during the different events. I already work in the props file with this command: BREAK_ONLY_BEFORE and a regular expression, and didn't work... I can't split it in the search statement because I'm trying to define the sourcetype... Do you have another idea? Thanks again!!! ... View more