Splunk Enterprise

props.conf not working to break the events after pipe line

ashwinipatil007
New Member

i am trying to break the events in the below data after each pipe (|),placed the props.conf on both UF and HF still doesn't apply
but when I am trying the same props.conf in the UI (add data) before indexing the data it is working.

HOSTNAME=**,PROGRAM=MANAGER,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAM
E=
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=*
,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP|HOSTNAME=***,PROGRAM=EXTRACT,FILENAME=TEST,STATUS=UP

tried with below 2 props.conf.

[sourcetype]
EVENT_BREAKER_ENABLE=true
EVENT_BREAKER=(|)

[sourcetype]
BREAK_ONLY_BEFORE = (|)

I am using splunk 7.0 version

Tags (1)
0 Karma

nickhills
Ultra Champion

Hi @ashwinipatil007

Try the following in your props.conf

[sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\|)

It wont hurt putting this on your UF, but it wont do anything. This needs to be on your indexers, or (heavy forwarders if you use them)

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Do you not have timestamps in any of your events?

If my comment helps, please give it a thumbs up!
0 Karma

ashwinipatil007
New Member

nope.
the props.conf are working fine when I try it before indexing the data but when I place them on HF (tried on UF as well) it is not breaking the events as expected.tried with below props.conf as well but no luck
I need to break the events before the PIPE in the above content.
any idea?

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...