Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Props.conf Multi Extraction Not working

$
0
0
Hello, Props.conf is not functioning like I expect. I have a scripted input that looks like this CONTAINERID IMAGE COMMAND CREATED STATUS PORTS NAMES 0dce14da9952 centos "/bin/bash -c 'while " 16 minutes ago Up 16 minutes grave_mayer 5969bffa8ad2 centos "/bin/bash -c 'while " 46 minutes ago Up 46 minutes distracted_jepsen So I created a props.conf looking like this [docker:ps] SEDCMD-fixspace1= s/CONTAINER ID/CONTAINERID/g SHOULD_LINEMERGE=false LINE_BREAKER=(^$|[\r\n]+[\r\n]+) TRUNCATE=1000000 DATETIME_CONFIG = CURRENT KV_MODE = multi Any idea why I am not getting an extraction for this?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>