Multiline event breaking not working

responsys_cm — Tue, 29 Sep 2020 17:38:33 GMT

I have a log source for LDAP that includes a mix of single line events and multiline events. The multiline events look something like:

Authentication request received from ip=x.x.x.x
Connecting to LDAP server "y.y.y.y"
Mapped uid=5401 to user 'joe'
Submitting authentication request
Authentication success for user 'joe'

My props.conf file has:

SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Authentication request received
MUST_BREAK_AFTER = Authentication success

When I do this, the "Authentication success" event always ends up in its own event. When I look at the timestamps, I see that there is usually a 3-10 second delay between the timestamp on the "Submitting authentication request" message and the "Authentication success" message.

Is there a setting that controls how long Splunk will tolerate a delay in messages before deciding to move on from the line breaking process? Any ideas on what the issue might be?

Thx.

Re: Multiline event breaking not working

micahkemp — Fri, 12 Jan 2018 18:56:20 GMT

Try this instead:

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\n\r]+)Authentication request received

topic Re: Multiline event breaking not working in Getting Data In

Multiline event breaking not working

Re: Multiline event breaking not working