Getting Data In

Do line breaking configs in props.conf apply to files that are manually uploaded to Splunk?

jambajuice
Communicator

I have a very simple config for an input in props.conf:

[fortinet_config]
SHOULD_LINEMERGE = True

If I use the "Upload a local file" option to index a config file, Splunk always breaks it up into individual lines.

Are stanzas in props.conf applied to files that are uploaded through the GUI?

Thx.

Craig

Tags (1)

Ron_Naken
Splunk Employee
Splunk Employee

They do apply to uploaded files. Here's a props.conf trick that's used by the *NIX app to consume long outputs as a single entry. A stanza like the following will allow you to consume your entire config file as a single event. Be sure to manually set your sourcetype on the Data Input to whatever you use in your stanza (myconfigs in the example):

[myconfigs]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000

gkanapathy
Splunk Employee
Splunk Employee

Yes, you should specify the sourcetype when uploading (unless your props.conf rules are based on source...but you have to be careful here, as the file path will be the path of the batch directory). Also, a less risky LINE_BREAKER would be (?!), which will never match. ^()$ will work in this context, but that regex will not always fail.

jrodman
Splunk Employee
Splunk Employee

They should apply, and if they do not (and have that sourcetype), that is a bug.

That configuration is not terribly extensive, so I'm uncertain what differences you are seeing. There could be a more complex case where the behavior relies on certain source:: based rules, which aren't matching for the upload behavior.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...