https://community.splunk.com/t5/Getting-Data-In/Indexed-CSV-wont-line-break/m-p/20403#M2986 <P>Im indexing a CSV file and i have SHOULD_LINEMERGE set to "false" so it will break after each new line.</P> <P>However per 24 hour period (and about 600,000 events), I get ~50 events which are not line broken correctly and have half of the event as a new event - How is this even happening if I have SHOULD_LINEMERGE=false? Isnt the default to break at a new line?</P> <P>The only think I am thinking is that a small subset of the events in the CSV are broken over two lines? (If that's even possible) Or is there a limit to the amount of characters that Splunk will check for a line break, before it just breaks the event at the limit?? So basically meaning that we had a few very long entries in the CSV file which Splunk didn't check all the way to the end due to a limit of some sort??</P> Thu, 05 Apr 2012 17:19:54 GMT jdunlea_splunk 2012-04-05T17:19:54Z https://community.splunk.com/t5/Getting-Data-In/Indexed-CSV-wont-line-break/m-p/20403#M2986 <P>Im indexing a CSV file and i have SHOULD_LINEMERGE set to "false" so it will break after each new line.</P> <P>However per 24 hour period (and about 600,000 events), I get ~50 events which are not line broken correctly and have half of the event as a new event - How is this even happening if I have SHOULD_LINEMERGE=false? Isnt the default to break at a new line?</P> <P>The only think I am thinking is that a small subset of the events in the CSV are broken over two lines? (If that's even possible) Or is there a limit to the amount of characters that Splunk will check for a line break, before it just breaks the event at the limit?? So basically meaning that we had a few very long entries in the CSV file which Splunk didn't check all the way to the end due to a limit of some sort??</P> Thu, 05 Apr 2012 17:19:54 GMT https://community.splunk.com/t5/Getting-Data-In/Indexed-CSV-wont-line-break/m-p/20403#M2986 jdunlea_splunk 2012-04-05T17:19:54Z https://community.splunk.com/t5/Getting-Data-In/Indexed-CSV-wont-line-break/m-p/20404#M2987 <P>The only time I've run into this is when the application that generated the csv file had corrupt data coming in. Can you post a sample of your data? </P> <P>If you're sure your dataset is clean, you may want to look at enabling SHOULD_LINEMERGE and then tweaking MUST_NOT_BREAK_BEFORE discussed here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents</A>.</P> Mon, 28 Sep 2020 11:38:17 GMT https://community.splunk.com/t5/Getting-Data-In/Indexed-CSV-wont-line-break/m-p/20404#M2987 jt_splunk 2020-09-28T11:38:17Z