topic How to extract a multi-line stack dump into a single event? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-extract-a-multi-line-stack-dump-into-a-single-event/m-p/121863#M25248 <P>I have a sourcetype that requires "SHOULD LINEMERGE=False" and I'm attempting to break out a multi-line event in that sourcetype. </P> <P>Basically, I'm attempting to capture the entire 'stack dump' as a single event in splunk. I thought line breaker would be a good method, however reading the documentation, it may not be a good fit. </P> <P>Does anyone have any ideas on how to extract a multi-line stack dump into a single event? </P> <P>This is an example of a dump:</P> <P><IMG src="http://answers.splunk.com//storage/tsrv_1.jpg" alt="alt text" /></P> Thu, 26 Jun 2014 21:06:53 GMT tmarlette 2014-06-26T21:06:53Z How to extract a multi-line stack dump into a single event? https://community.splunk.com/t5/Getting-Data-In/How-to-extract-a-multi-line-stack-dump-into-a-single-event/m-p/121863#M25248 <P>I have a sourcetype that requires "SHOULD LINEMERGE=False" and I'm attempting to break out a multi-line event in that sourcetype. </P> <P>Basically, I'm attempting to capture the entire 'stack dump' as a single event in splunk. I thought line breaker would be a good method, however reading the documentation, it may not be a good fit. </P> <P>Does anyone have any ideas on how to extract a multi-line stack dump into a single event? </P> <P>This is an example of a dump:</P> <P><IMG src="http://answers.splunk.com//storage/tsrv_1.jpg" alt="alt text" /></P> Thu, 26 Jun 2014 21:06:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-a-multi-line-stack-dump-into-a-single-event/m-p/121863#M25248 tmarlette 2014-06-26T21:06:53Z Re: How to extract a multi-line stack dump into a single event? https://community.splunk.com/t5/Getting-Data-In/How-to-extract-a-multi-line-stack-dump-into-a-single-event/m-p/121864#M25249 <P>You could put the following in <CODE>props.conf</CODE></P> <PRE><CODE>[yoursourcetypehere] SHOULD_LINEMERGE=false BREAK_ONLY_BEFORE=-- Memory Info Start -- </CODE></PRE> Thu, 26 Jun 2014 21:56:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-a-multi-line-stack-dump-into-a-single-event/m-p/121864#M25249 lguinn2 2014-06-26T21:56:49Z