topic Re: Line break in multiline event in Getting Data In

Line break in multiline event

RobertRi — Tue, 22 Jan 2013 14:44:21 GMT

I have a script which gather each db and display the schema, name, tablesapce indexspace and date from each table

It looks like this
schema name tablesapce indexspace date
SYS Table1 3434 3432 2013-01-22
SYS Table2 34535 33 2013-01-22

When I get an event under 257 Tables, they were displayed as one event.
If I get and event whit more than 257 Tables then the first event is a 257 line event and the other hundrets of events are single line events.

I have set MAX_EVENTS = 5000 in the inputs.conf and restarted the forwarder but without success

Do you have any hints how I get this events as one multiline event?

Thanks
Rob

Re: Line break in multiline event

stefano_guidoba — Mon, 28 Sep 2020 13:09:40 GMT

in props.conf set SHOULD_LINEMERGE parameter for this particular input to false
[sourcetype]
SHOULD_LINEMERGE = false

By default it's set to true, so Splunk will assume that until a line breaker event is found (e.g. a timestamp) all the following data are grouped in one single event. After 256 lines, Splunk automatically cut the event.

Re: Line break in multiline event

RobertRi — Mon, 28 Sep 2020 13:10:12 GMT

Hi Stefano

I have used the following in the props.conf on the forwarder to keep the multiline event together.

[sourcetype]
SHOULD_LINEMERGE = true
MAX_EVENTS = 5000

now the events are gathered together

Re: Line break in multiline event

stefano_guidoba — Wed, 23 Jan 2013 11:14:01 GMT

sorry, I thought you were asking how to split lines in single events 🙂 Glad you've found the solution anyway!
BTW SHOULD_LINEMERGE is set True by default so you won't need to specify it in props.conf 🙂

Re: Line break in multiline event

RobertRi — Wed, 23 Jan 2013 11:27:56 GMT

you gave me the necessary hint, thanks