By default, every line of input to Splunk is considered a separate event. To change that, edit the props.conf file for the source type and change the LINE_BREAKER
setting. Set the value to a regular expression that contains a capture group where one event ends and the next begins. I'd suggest such a regex, but can't do so without seeing more example data.
There are other props.conf settings you can use if LINE_BREAKER
doesn't solve the problem. For instance, BREAK_ONLY_BEFORE
, BREAK_ONLY_BEFORE_DATE
, or MUST_BREAK_AFTER
.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.