topic Re: Why is linecount 2 when it's clearly 1? in Getting Data In

Why is linecount 2 when it's clearly 1?

danielbb — Thu, 17 Apr 2025 16:57:56 GMT

For multiple sourcetypes, linecount is 2, while clearly, it should be 1. Has anybody encountered this case?

Re: Why is linecount 2 when it's clearly 1?

richgalloway — Thu, 17 Apr 2025 17:26:42 GMT

Example? Screenshot?

Re: Why is linecount 2 when it's clearly 1?

livehybrid — Fri, 18 Apr 2025 11:19:18 GMT

Hi @danielbb

Please could you share a sample event and screenshot of this so we try and repeat this issue and/or diagnose?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Why is linecount 2 when it's clearly 1?

danielbb — Fri, 18 Apr 2025 15:43:29 GMT

Thank you, @livehybrid, @richgalloway, I'll get screenshots but, a related question, how do I access the second line of _raw?

Re: Why is linecount 2 when it's clearly 1?

isoutamo — Fri, 18 Apr 2025 16:10:20 GMT

In splunk _raw is only one line, but it can contains e.g. \n character.
You could see it e.g. “table _raw”

Re: Why is linecount 2 when it's clearly 1?

danielbb — Mon, 21 Apr 2025 20:52:23 GMT

@isoutamo I'm running the following -

index = <my_index> linecount=2 | table _raw

and everything shows up as one line, I don't see any sign of \n, what do I miss?

I also checked with an encoding tool and it doesn't show either the 13 ascii code or the 10 one within these lines.

My biggest confusion is the fact that for this sourcetype I have -

SHOULD_LINEMERGE=FALSE

And therefore, how come, sometimes the events have multiple lines?

Re: Why is linecount 2 when it's clearly 1?

danielbb — Tue, 22 Apr 2025 14:44:44 GMT

I came across an identical thread at Re: How does Splunk calculate linecount? - Splunk Community

Re: Why is linecount 2 when it's clearly 1?

isoutamo — Tue, 22 Apr 2025 17:05:32 GMT

Hoe you have defined line breaking?

Re: Why is linecount 2 when it's clearly 1?

livehybrid — Tue, 22 Apr 2025 22:04:29 GMT

Hi @danielbb

It could be something like a field extraction happening after the line breaking which is causing this, or something else. Without access to your instance we could do with seeing some sample logs along with a btool output ($SPLUNK_HOME/bin/splunk btool props list <sourceTypeName>) for your event's sourcetype.

The thread you posted from 2013 looks like could have been related to the events having a line-break in.

Please let us know if you're able to provide a sample + props output.

Thanks