https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/678040#M113318 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;How to do it during index time? What changes need to be made in line break settings?</P> Tue, 20 Feb 2024 05:29:50 GMT Avantika 2024-02-20T05:29:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/210770#M41523 <P>Attached is a screenshot of the way my logs are appearing in Splunk. They match the log files themselves exactly, separating out each entry regardless of the timestamp. The pattern is the same for each new event (INFO | JVM1...) and we want to try to “linemerge” events that have the same exact timestamps (Examples hightlighted).</P> <P>How would I approach this issue?</P> <P>Thanks!</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1067i0172DAC178316EEA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 22 Feb 2016 17:28:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/210770#M41523 thompsonsgg 2016-02-22T17:28:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/210771#M41524 <P>Do you want to merge them at index time or search time?</P> Mon, 22 Feb 2016 18:18:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/210771#M41524 richgalloway 2016-02-22T18:18:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/210772#M41525 <P>At search time, try the transaction command.</P> <P>Or use the poor man transaction " ... | stats values(_raw) by source sourcetype host index _time "</P> Mon, 22 Feb 2016 18:19:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/210772#M41525 yannK 2016-02-22T18:19:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/678040#M113318 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;How to do it during index time? What changes need to be made in line break settings?</P> Tue, 20 Feb 2024 05:29:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/678040#M113318 Avantika 2024-02-20T05:29:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/678078#M113324 <P>You may be able to adjust the props.conf settings to change how events are ingested.&nbsp; Can you share raw events?</P> Tue, 20 Feb 2024 14:06:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-lines-based-on-timestamps/m-p/678078#M113324 richgalloway 2024-02-20T14:06:39Z