Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why is must_break_after configuration not working?

$
0
0
I have a large (10's of thousands of lines) data stream that runs every 10 minutes and I want it to break after this line: sharing = default_shared I tried putting in: MUST_BREAK_AFTER = (sharing = default_shared) But this did not work. I was hoping it would take the literal string, but it's not working.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>