Splunk 101: The Magic 8
The Magic 8 (formerly known as the Magic 6), are props.conf configurations to use when you build out props for data - these are the 6-8 configurations that you absolutely need. Why? Splunk serves us with a lot of automation.. but as we know, the auto"magic" parts don't always get it right. Or at least, it can be pretty basic and heavily lean on default settings.
While you're watching the video, take a look at this resource, The Aplura Cheat Sheet (referenced in the video): https://www.aplura.com/assets/pdf/onb...
The Magic 8 configurations you'll need are...
SHOULD_LINEMERGE = false (always false)
LINE_BREAKER = regular expression for event breaks
TIME_PREFIX = regex of the text that leads up to the timestamp
MAX_TIMESTAMP_LOOKAHEAD = how many characters for the timestamp
TIME_FORMAT = strptime format of the timestamp
TRUNCATE = 999999 (always a high number)
EVENT_BREAKER_ENABLE = true*
EVENT_BREAKER = regular expression for event breaks*
In Part One, we'll be covering the first two on our list: SHOULD_LINEMERGE and LINE_BREAKER.
In Part Two, we'll review 3-8.