Hi
My input file /tmp/log.txt looks like this.
192.168.22.5 93.x.x.x 456 2
192.168.22.10 183.x.x.x 63 1
src_ip dest_ip byte packet
When I add this file as an input file in Splunk, I get all data as one large event.
I would like these events top be split to separate lines.
So in **props.conf** i added:
[source::///tmp/log.txt]
SHOULD_LINEMERGE = false
But that did not help.
Not sure If I need to have `**/**` or `**///**` before file name, but nothing splits the line.
↧