All Apps and Add-ons

Splunk queries

anandhalagarasa
Path Finder

General queries

0 Karma

woodcock
Esteemed Legend

Try this

SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = !%&#ThisIsGarbageRegexThatWillNeverMatch!%&#

cpetterborg
SplunkTrust
SplunkTrust
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi anandhalagarasan,
you have to insert in your sourcetype stanza of your props.conf the option SHOULD_LINEMERGE= true and maybe identify start point event.
I suggest to download an example of your configuration files and try to ingest it using the web interface, in this way you can immediately set your sourcetype.
Bye.
Giuseppe

0 Karma

anandhalagarasa
Path Finder

So kindly help on this request.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You have edited your question to be completely useless in any context. Why did you do that?

It is also bad form to down vote a response that is not incorrect, even if it doesn't directly answer your question. If it is still correct, then you should not down vote an answer.

It is also GOOD form to accept an answer that does answer your question.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...