I am expecting to see each record as an event, but the result is not as expected. Some records are displayed as individual events, but some are grouped into one event.
1 5/26/10 9:19:21.000 AM FI.02-8947FI.02-8957FI.02-8979FI.03-8087FI.03-8171FI.03-8208FI.03-8270FI.03-8013FI.03-8278FI.03-8314 Show all 131 lines 2 5/26/10 9:19:20.000 AM FI.02-8886
3 5/26/10 9:19:20.000 AM FI.02-8877
4 5/26/10
[host::imappl01dev] LINE_BREAKER = ([\r\n]+)
[default]
[monitor:///opt/applocal/sb1/utils/log/ADO_COUNT/*N0ADOs_to_be_Consolidated*] index = iss-rdr sourcetype = IntADOsNotConsolidated
[monitor:///opt/applocal/sb1/utils/log/ADO_COUNT/] index = iss-rdr sourcetype = IntADOsNotNormalized whitelist = /ADOsNotNormalized/?
Please help me to see each record as an individual event.
Thank you
Your issues is with event breaking not line breaking. (You shouldn't have to mess with the LINE_BREAKER
setting.)
I'm not sure if you assigned line numbers to your events of they are in the raw event data. If they are in the raw data, then it's possible that your it is confusing the date parser. So probably the best place to start is by setting up an explicit date format and telling splunk what junk to expect before the date. (The example given will match with or without the leading digit, so it should work either way.)
I would try setting the following in your props.conf
file: (Note that I'm using the sourcetype of your events instead of creating a host::
matching stanza because that's generally a better approach, at least from my experience.)
[IntADOsNotConsolidated]
TIME_PREFIX = ^(?:\d+ +)?
# Date look like: 5/26/10 9:19:21.000 AM
TIME_FORMAT = %m/%d/%y %I:%M:%S.%3N %P
BREAK_ONLY_BEFORE_DATE = True
If your event are always exactly one line, then you can remove the BREAK_ONLY_BEFORE_DATE
entry, and replace it with the following:
SHOULD_LINEMERGE = False
As with all settings like this, these changes to your props.conf
file will only effect newly indexed data after a splunk restart.