https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23950#M3767 <P>Probably an issue with the timestamps. See if this helps:</P> <PRE><CODE># props.conf [my_sourcetype] SHOULD_LINEMERGE = false TIME_FORMAT = %H:%M:%S,%n </CODE></PRE> Tue, 07 Jun 2011 13:49:45 GMT mw 2011-06-07T13:49:45Z https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23949#M3766 <P>Hello,</P> <P>I have a log file that is being indexed and many of the lines show up combined into multi-line events however there seems to be no logic behind the combining. Each line has a timestamp yet they are being combined regardless. I have no props.conf in this config - therefore I assume default line merging is in effect.</P> <H2>Example log data:</H2> <P>08:26:53,465 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap</P> <P>08:26:53,561 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap</P> <P>08:26:53,699 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap</P> <P>08:26:53,765 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap</P> <P>08:26:59,234 WARN [org.alfresco.repo.cache.TransactionalCache.org.alfresco.cache.avmNodeTransactionalCache] Transactional update cache 'org.alfresco.cache.avmNodeTransactionalCache' is full (5000).</P> <P>08:27:05,532 WARN [org.alfresco.repo.cache.TransactionalCache.org.alfresco.cache.contentDataTransactionalCache] Transactional update cache 'org.alfresco.cache.contentDataTransactionalCache' is full (1000).</P> <P>08:27:23,223 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap</P> <P>08:27:23,961 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap</P> <P>08:27:23,962 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'OOoDirect' subsystem, ID: [OOoDirect, default]</P> <P>08:27:23,988 INFO [org.alfresco.config.FixedPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/version.properties]</P> <H2>Result</H2> <P>The result is some of the lines are combined to multi-line and some are not but I cannot distinguish what is causing the combining/breaking.</P> <H2>Question</H2> <P>Is it possible to configure a regex to recognize the timestamp on the new line and then use props.conf to further configure the line breaking?</P> <P>Thanks,<BR /> John</P> Tue, 07 Jun 2011 13:32:48 GMT https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23949#M3766 frankejj 2011-06-07T13:32:48Z https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23950#M3767 <P>Probably an issue with the timestamps. See if this helps:</P> <PRE><CODE># props.conf [my_sourcetype] SHOULD_LINEMERGE = false TIME_FORMAT = %H:%M:%S,%n </CODE></PRE> Tue, 07 Jun 2011 13:49:45 GMT https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23950#M3767 mw 2011-06-07T13:49:45Z https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23951#M3768 <P>Thanks! Setting the time format did the trick. I did not change line merge to false because there are also many multi-line entries in these logs.</P> Mon, 13 Jun 2011 11:42:28 GMT https://community.splunk.com/t5/Getting-Data-In/Single-events-are-combined-into-multi-line-events/m-p/23951#M3768 frankejj 2011-06-13T11:42:28Z