How to merge all lines into one single event?

[danielearangiom]

Hi,
How can I merge all lines of a config file into one single event?
My inputs.conf is:

[monitor:D:\CatTools3\Config.Current.Running.ASA-CLI.txt]
sourcetype = CatTools:Firewall:ASA-CLI
host_regex = Config.Current.Running.(?P.+)
index = eli

And my props.conf is:
[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = TRUE

But on Splunk search, each line is a single event, so now I have more than 5000 events instead of one event of 5000 lines.

[danielearangiom · Accepted solution]

Finally I solved by putting the following rows of my props.conf into the deployment server and also the index server:

[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = TRUE
LINE_BREAKER = (ALL_ROWS_INTO_ONE_EVENT)
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
MAX_EVENTS = 100000

[richgalloway]

@danielearangiomazza If your problem is resolved, please accept an answer to help future readers.

[Lazarix]

Try this in props.conf:

[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE=gobbldegook
MAX_EVENTS=200000
LINE_BREAKER = ((*FAIL))
TRUNCATE=99999999

The break only before and line breaker above are set to something that should not match in the source file.
There is also a 500 line default for max events which we are bypassing above.
The result should be that the entire ASA config is imported as a single event.

[danielearangiom]

Same as before, nothing change.

[richgalloway]

After modifying props.conf you must restart your indexer(s) for the change to take effect.
Changes to props.conf only apply to NEW data. Events already indexed will not change.

[danielearangiom]

Done, same as before

[richgalloway]

How are you breaking events? The default setting is by line, even with line merging turned on.

[danielearangiom]

What do you mean? Where can i see this setting?

[richgalloway]

It will be in props.conf. If you have access to the CLI, run this command. It will show all of the properties for that sourcetype. Look for LINE_BREAKER, which is probably set to the default value of "([\r\n]+)". You should change the value in parentheses to something that separates one event from another.

splunk btool --debug props list CatTools:Firewall:ASA-CLI | more