The “Magic 8” Configurations You Need in Splunk

 

When working in Splunk, you can earn major magician status with all of the magic tricks you can do with your data. Every magician needs to prepare for their tricks… and in the case of Splunk, that preparation comes through data onboarding. That’s where the Magic 8 props.conf configurations come in to help you set up for your big “abracadabra” moment.

The Magic 8 (formerly known as the Magic 6), are props.conf configurations to use when you build out props for data – these are the 6-8 configurations that you absolutely need. Why? Splunk serves us with a lot of automation.. but as we know, the auto”magic” parts don’t always get it right. Or at least, it can be pretty basic and heavily lean on default settings.

While you’re watching the video, take a look at this resource, The Aplura Cheat Sheet (referenced in the video).

The Magic 8 configurations you’ll need are…

  1. SHOULD_LINEMERGE = false (always false)
  2. LINE_BREAKER = regular expression for event breaks
  3. TIME_PREFIX = regex of the text that leads up to the timestamp
  4. MAX_TIMESTAMP_LOOKAHEAD = how many characters for the timestamp
  5. TIME_FORMAT = strptime format of the timestamp
  6. TRUNCATE = 999999 (always a high number)
  7. EVENT_BREAKER_ENABLE = true*
  8. EVENT_BREAKER = regular expression for event breaks*

You’ll notice the * on #7 and #8. These configs are new to the list! The * indicates these configurations are useful “with forwarders > 6.5.0.” In Part One, we’ll be covering the first two on our list: SHOULD_LINEMERGE and LINE_BREAKER. In Part Two, we’ll review 3-8.

You may have read a few of Josh’s Splunk Search Command Series blogs, both Josh, and our engineers here at Kinney Group produce weekly content around Splunk best practices. The Tech Ops team runs our Expertise on Demand service. Team Tech Ops is responsible for knowing everything and anything around Splunk best practice… that’s why you’ll get access to a ton of video and written content from these rockstars.

Meet our Expert Team

If you’re a Splunker, or work with Splunkers, you probably have a full plate. Finding the value in Splunk comes from the big projects and the small day-to-day optimizations of your environment. Cue Expertise on Demand, a service that can help with those Splunk issues and improvements to scale. EOD is designed to answer your team’s daily questions and breakthrough stubborn roadblocks. We have the team here to support you. Let us know below how we can help.

Author

Start typing and press Enter to search