|
Currently when splunk eats the serviceperf and hostperf data the events come in as multi-line events. When in the nagios web view selecting splunk for a host may return a multi-line event that contains other hosts that came in at the same time. Is this as it should be? Would I be creating more problems by splitting the events so there is one single nagios event per event in splunk? Thanks in advance. |
One Answer:
|
Your props.conf should already have the following entry to ensure that each event is indexed as a single line: You could try restarting splunk, I often find that this can solve line breaking issues :) All the best, Luke :) |
