script (.bat) only outputs the first 9 lines - manually running command outputs 70+

[wgawhh5hbnht]

I'm attempting to get DHCP lease info and as far as I can tell I need write a script to get this info (please let me know if there is a better way!).
My .bat file (placed in /bin):

@echo off
REM --------------------------------------------------------
REM pull DHCP Lease subnets for ES
REM --------------------------------------------------------
netsh dhcp server show mibinfo

My inputs.conf:

[script://.\bin\win_dhcp_lease.bat]
disabled = 0
interval = 60
index = windows
sourcetype = Script:dhcp_lease

The results in splunk only show the first 9 lines of the output:

MIBCounts:
    Discovers = 1074.
    Offers = 1070.
    Delayed Offers = 0.
    Requests = 58132.
    Acks = 59256.
    Naks = 6.
    Declines = 0.
    Releases = 0.

When I manually run "netsh dhcp server show mibinfo" I get the following output:

PS C:\Windows\system32>
MIBCounts:
        Discovers = 1043.
        Offers = 1039.
        Delayed Offers = 0.
        Requests = 54222.
        Acks = 55291.
        Naks = 6.
        Declines = 0.
        Releases = 0.
        ServerStartTime = Saturday, August 24, 2019 12:13:06 AM
        Scopes = 15.
        Scopes with Delay configured= 0.
        Subnet = 10.0.0.0.
                No. of Addresses in use = 13.
                No. of free Addresses = 222.
                No. of pending offers = 0.
        Subnet = 10.0.1.0.
                No. of Addresses in use = 1.
                No. of free Addresses = 234.
                No. of pending offers = 0.
        Subnet = 10.0.2.0.
                No. of Addresses in use = 137.
                No. of free Addresses = 98.
                No. of pending offers = 0.
        Subnet = 10.0.3.0.
                No. of Addresses in use = 78.
                No. of free Addresses = 157.
                No. of pending offers = 0.
        Subnet = 10.0.4.0.
                No. of Addresses in use = 18.
                No. of free Addresses = 217.
                No. of pending offers = 0.
        Subnet = 10.0.5.0.
                No. of Addresses in use = 139.
                No. of free Addresses = 96.
                No. of pending offers = 0.
        Subnet = 10.0.6.0.
                No. of Addresses in use = 16.
                No. of free Addresses = 205.
                No. of pending offers = 0.
        Subnet = 10.0.7.0.
                No. of Addresses in use = 0.
                No. of free Addresses = 241.
                No. of pending offers = 0.
        Subnet = 10.0.8.0.
                No. of Addresses in use = 0.
                No. of free Addresses = 235.
                No. of pending offers = 0.
        Subnet = 10.0.9.0.
                No. of Addresses in use = 117.
                No. of free Addresses = 124.
                No. of pending offers = 0.
        Subnet = 10.0.10.0.
                No. of Addresses in use = 95.
                No. of free Addresses = 146.
                No. of pending offers = 0.
        Subnet = 10.0.11.0.
                No. of Addresses in use = 107.
                No. of free Addresses = 134.
                No. of pending offers = 0.
        Subnet = 10.0.12.0.
                No. of Addresses in use = 62.
                No. of free Addresses = 179.
                No. of pending offers = 0.
        Subnet = 10.0.13.0.
                No. of Addresses in use = 122.
                No. of free Addresses = 119.
                No. of pending offers = 0.
        Subnet = 10.0.14.0.
                No. of Addresses in use = 20.
                No. of free Addresses = 21.
                No. of pending offers = 0.
PS C:\Windows\system32>

[wgawhh5hbnht · Accepted solution]

Moved the props.conf from UF to indexer...duh
then made the following changes to props.conf:

[Script:dhcp_lease]
SHOULD_LINEMERGE = true
DATETIME_CONFIG = CURRENT
TRUNCATE = 999999
BREAK_ONLY_BEFORE = MIBCounts

all lines are now showing and in 1 event.

[woodcock]

White this may work, you are doing twice as much work to (doing your linebraking work twice) and wasting cycles on every event for this sourcetype. There are VERY good reasons that those of us with experience always suggest using SHOULD_LINEMERGE = false and LINE_BREAKER = (like in my answer).

[wgawhh5hbnht]

I've also attempted to output the results of the .bat to a file & the file also gets cut off after the first 9 lines.

[woodcock]

Try this:

[Script:dhcp_lease]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = CURRENT
LINE_BREAKER = (This Should Never Match; All Lines are ONE EVENT)
TRUNCATE = 999999

[wgawhh5hbnht]

Same outcome.
I've verified the splunk agent is restarting on the DCHP servers after each deployment push. Any other thoughts?

[woodcock]

These settings are correct so it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

[jacobpevans]

I'd bet money that there is a separate event with a _time of Saturday, August 24, 2019 12:13:06 AM. Your sourcetype is not defined to properly parse the timestamp so when it sees the line below, it starts a new event with a different time. That event will have the rest of your data.

ServerStartTime = Saturday, August 24, 2019 12:13:06 AM

Use the TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, and TIME_FORMAT properties in props.conf to properly parse the timestamp for the sourcetype defined by this script OR the lazy way to fix it is to set timestamp extraction to "Current time" since you know the event should always be very close to the current time (the time the script runs).

https://docs.splunk.com/Documentation/Splunk/latest/Admin/PropsConf

[wgawhh5hbnht]

Sorry, I should have also posted my props.conf.
Please let me know something isn't right, I've changed this many times and still I'm unable to get it to work:

[Script:dhcp_lease]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
TRUNCATE = 0