Getting Data In

props.conf how to break event after every new line?

Kitteh
Path Finder

As stated in the question, my props.conf has the following settings:

[daemonforCent]
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE=false

And as you can see, the result is still the same, not breaking anything. I've tried BREAK_ONLY_BEFORE=\r\n too but also will not work.

alt text

0 Karma

dantimola
Communicator

Was your problem resolved already? Please give me feedback as I'm having the same problem as well. Thank you.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Your props.conf is correct but these settings only apply at index time. You will need to be sure the props are on the forwarder(s) or indexer(s), and reingest any data that wasn’t properly ingested before.

Kitteh
Path Finder

they are done at the forwarders which worked well for ubuntu side with similar props settings.

0 Karma

MuS
SplunkTrust
SplunkTrust

Is this forwarders as in parsing heavy weight forwarders?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Kitteh,
let me understand: do you want to have a row in each event?
if yes use SHOULD_LINEMERGE = false

Bye.
Giuseppe

0 Karma

Kitteh
Path Finder

I want them to be separated into different event, so basically its just "abrtd (pid 2637)-running" as one event. So basically I suppose having rows do not matter as long events are splitted apart as its own.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...