I am monitoring a file from linux host but splunk is showing only the first line. I want to display the entire file content. I will be running a script which will generate a file with multiple line everytime and I want to stream the entire file to splunk. The below is my config, am I missing something?
splunk:
monitors:
- index: "test-index"
file: "/path/my-data-*"
sourcetype: "testsource-{{profile.pipelineBuildNumber}}"
multiline_event_extra_waittime: "true"
Added config to inputs.conf and props.conf, restarted splunk and it worked as expected.
input.conf
props.conf