Getting Data In

event splitting

romantercero
Path Finder

Other than props.conf, is there any other file that controls how multi-line events are split or kept together? We are having some strange issues where an event is bundled together with lines that correspond to another event on one day and then the next day having that same event type split up incorrectly in to many chunks of lines. No configuration changes have taken place in between these two occurrences so this is really odd.

Thanks!

Tags (3)
0 Karma

jbsplunk
Splunk Employee
Splunk Employee

you may want to post more information on the specifics of the problem you're observing, I don't know that we'll be able to do much to help you without understanding what is already in props.conf and examples of the behavior in the form of sample event data.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Line breaking is defined in props.conf, there aren't other config files that would instruct Splunk on how to deal with the data.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...