topic Multiple lines in a single event CSV in Getting Data In

Multiple lines in a single event CSV

rdgg97 — Mon, 12 Aug 2019 21:46:41 GMT

Hi.

I have the following CSV entry. The problem is that splunk take events from every line, but i have to merge multiple lines in a single event.

101,102,103

104,105,106

107,108,109
,,,RA,FA,DA
,,,TE,TS,POL

110,111,112

Re: Multiple lines in a single event CSV

Sukisen1981 — Tue, 13 Aug 2019 04:36:49 GMT

how does splunk show the events now and how do you want it?

Re: Multiple lines in a single event CSV

Kawtar — Tue, 13 Aug 2019 06:55:55 GMT

Hello
You should use this settings you may need to specify in your props.conf.

SHOULD_LINEMERGE = true

Re: Multiple lines in a single event CSV

Kawtar — Tue, 13 Aug 2019 07:02:24 GMT

Hello,

There are other settings you may need to specify in your props.conf.

Make sure SHOULD_LINEMERGE is set to true.

     ## props.conf ##

     SHOULD_LINEMERGE = TRUE

Regards,

Re: Multiple lines in a single event CSV

rdgg97 — Tue, 13 Aug 2019 14:42:28 GMT

Splunk shows the events as follow:

Event) INFO

1) 101,102,103
2) 104,105,106
3) 107,108,109
4) , , RA, FA, DA
5) , , TE, TS, POL
6) 110,111,112

And I want to splunk take events 3,4 & 5 as one

1) 101,102,103
2) 104,105,106
3) 107,108,109
, , RA, FA, DA
, , TE, TS, POL
6) 110,111,112

Re: Multiple lines in a single event CSV

rdgg97 — Tue, 13 Aug 2019 14:46:07 GMT

Thank you. I tried but nothing changed.

Re: Multiple lines in a single event CSV

Sukisen1981 — Wed, 30 Sep 2020 01:45:38 GMT

try this in your props.conf
Add a new stanza for your sourcetype, make sure to save your sourcetype while uploading the csv as a unique name
[your unique sourcetype]
BREAK_ONLY_BEFORE = ^\d+\s*$
make
SHOULD_LINEMERGE = FALSE, revert back the default settings for SHOULD_LINEMERGE