I am expecting to see each record as an event, but the result is not as expected. Some records are displayed as individual events, but some are grouped into one event.
The result set looks like this:
1 5/26/10
9:19:21.000 AM FI.02-8947FI.02-8957FI.02-8979FI.03-8087FI.03-8171FI.03-8208FI.03-8270FI.03-8013FI.03-8278FI.03-8314
Show all 131 lines
2 5/26/10
9:19:20.000 AM FI.02-8886
3 5/26/10
9:19:20.000 AM FI.02-8877
4 5/26/10
9:19:20.000 AM FI.02-8865
Following below are the contents of props.conf file:
[host::imappl01dev]
LINE_BREAKER = ([\r\n]+)
MAX_EVENTS = 1
Following below are the contents of inputs.conf file:
[default]
[monitor:///opt/applocal/sb1/utils/log/ADO_COUNT/*N0ADOs_to_be_Consolidated*]
index = iss-rdr
sourcetype = IntADOsNotConsolidated
[monitor:///opt/applocal/sb1/utils/log/ADO_COUNT/]
index = iss-rdr
sourcetype = IntADOsNotNormalized
whitelist = /ADOsNotNormalized/?
Please help me to see each record as an individual event.
Thank you
... View more