https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97282#M20280 <P>I'm experiencing an issue where logging to splunk over the network (either via TCP or UDP) sometimes chunks multiple lines into the same log entry. Is there any way to force these entries to be split as splunk receives them from the port?</P> Wed, 01 Dec 2010 23:43:53 GMT rwallace 2010-12-01T23:43:53Z https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97282#M20280 <P>I'm experiencing an issue where logging to splunk over the network (either via TCP or UDP) sometimes chunks multiple lines into the same log entry. Is there any way to force these entries to be split as splunk receives them from the port?</P> Wed, 01 Dec 2010 23:43:53 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97282#M20280 rwallace 2010-12-01T23:43:53Z https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97283#M20281 <P>You probably want to use LINE_BREAKER in your props.conf. See the following link for a detailed description: </P> <P><A href="http://www.splunk.com/base/Documentation/latest/Admin/Indexmulti-lineevents" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Indexmulti-lineevents</A></P> <P>If this isn't particularly helpful, could you describe the data in more detail? If you could provide a sample of what your seeing, that might be useful in clarifying the situation. </P> Thu, 02 Dec 2010 01:45:02 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97283#M20281 jbsplunk 2010-12-02T01:45:02Z https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97284#M20282 <P>Thanks for the link! It looks like setting SHOULD_LINEMERGE to false fixed the problem.</P> Sat, 04 Dec 2010 02:30:48 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-logs-sent-over-the-network/m-p/97284#M20282 rwallace 2010-12-04T02:30:48Z