We have 2 large datafeeds into Splunk, email and SQL Trace outputs, but the CRLF characters in both feeds are creating more than 3 times as many Events as there are actual records (individual emails or trace records). What is the best practice for this? Firstly - to preserve the line break, but not confuse Splunk. And secondly, how do we deal with the already existing in Splunk?
Thank you very much in advance!
Jon
NYC
Hi Jon, you'll want to configure props.conf for that sourcetype to linebreak differently than the default (which is new-line)
Concerning the already existing events, I believe there isn't a whole lot of opportunity to alter them. It's recommended that you use a test index until you have the sourcetype's configured as you want them.
Hi Muebel,
Thank you very much for your answer! Since this is only occurring within one source column, would you also recommend simply replacing the CRLF characters with the HTML tag "
" before sending Splunk the data so the event parser will work as expected, but we will also still be able to see the line-breaks when viewing the data?
Thanks again,
Jon