Line Breaking event into multiple events -

splunker12er — Mon, 22 Sep 2014 06:52:51 GMT

Sample log:

Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: PCI bridge to [bus 11-11]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [io  0xf000-0x0000] (disabled)
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [mem 0xd3d00000-0xd3dfffff]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [mem 0xd5300000-0xd53fffff 64bit pref]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.7: PCI bridge to [bus 12-12]

props.conf:

[my_custom]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true

I set the above property to break that single event , but it seems it doesnt work, since the Timestamp is same in all the events does it always consider this as a single event ?

or any other settings to include in my props ? Please help

Source : http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Indexmulti-lineevents

Re: Line Breaking event into multiple events -

lguinn2 — Mon, 22 Sep 2014 09:35:04 GMT

If all events are a single line, it would be significantly more efficient to do this:

 [my_custom]
 SHOULD_LINEMERGE = false

Also, your settings are the default, so you shouldn't need them anyway. Is it possible that Splunk is not interpreting the timestamp correctly? If Splunk doesn't recognize the timestamp, then your BREAK_ONLY_BEFORE_DATE = true setting will not work.

my_custom should be the name of the sourcetype of the data - it must match exactly, including case.

topic Re: Line Breaking event into multiple events - in Getting Data In

Line Breaking event into multiple events -

Re: Line Breaking event into multiple events -