merging as single event from mutlple lines

roopeshetty — Thu, 18 Jan 2024 07:55:34 GMT

Hi Guys,

We are collecting the Kubernetes logs using HEC on our Cloud splunk. When ever there is a ERROR entry in the logs , it will have a timestamp in the first line and later lines will be logged as below one after one which will have a information about that error.

But when we see it in Splunk console these lines will be splitted as multiple events as below which is leading to confusion.

Is there anyway we can merge these particular lines as single events so that all lines related to any error should be visible as a single event. Please help on this.

Re: merging as single event from mutlple lines

PickleRick — Thu, 18 Jan 2024 11:09:00 GMT

There is no such thing as "merging" events.

If you're sending to the /event endpoint, you have to make sure you're sending whole events. I'm not 100% how/if linebreaking works with /raw endpoint.

topic Re: merging as single event from mutlple lines in Getting Data In

merging as single event from mutlple lines

Re: merging as single event from mutlple lines