topic Re: How does Splunk calculate linecount? in Getting Data In

How does Splunk calculate linecount?

mloven_splunk — Mon, 07 Oct 2013 17:29:45 GMT

I have logs that are linebreaking correctly, and are single line events, but the linecount is showing as "2".

I poked around in the original file and there seems to only be single line endings on each line (per vi :set list)

What does Splunk use to calculate linecount?

Re: How does Splunk calculate linecount?

twistedsixty4 — Wed, 05 Feb 2014 23:53:50 GMT

I dont know if this answers your question, but you might find your answer here..
http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Indexmulti-lineevents

Re: How does Splunk calculate linecount?

jplumsdaine22 — Wed, 02 Mar 2016 15:12:08 GMT

@mloven now that you work for Splunk did you get an answer? I'm seeing the same behavior

Re: How does Splunk calculate linecount?

cramasta — Mon, 15 Aug 2016 20:27:25 GMT

Also seeing the same behavior where one line events are showing up at 2. Also only seeing single line endings when checking out the log on the forwarder host

Re: How does Splunk calculate linecount?

mattymo — Thu, 27 Apr 2023 16:27:25 GMT

Hello from the future!

I ran into this exact thing working with OpenTelemetry's HEC exporter.

It turns out if the "raw" field contains a "\n" it will increment the linecount to 2.

This is likely because Splunk's default line breaker behaviour is to drop any new lines as part of the capture group it uses "([\r\n]+)" so the logic assumes new lines would be removed.

so if it somehow sneaks into raw (in my case it skips linebreaking due to hec event endpoint) even tho you dont see it in the raw even on screen it looks to trigger the linecount to be 2.