topic Re: Searching for merged events in Splunk in Splunk Search

Searching for merged events in Splunk

nawazns5038 — Mon, 10 Jun 2019 22:35:35 GMT

Hi,

I have found that there are some events in Splunk that are merged and it is on a random basis and in a huge dataset.

Can I please know if there is a way to find the events that are merged.

All the events are in JSON format.

Thanks

Re: Searching for merged events in Splunk

Shan — Tue, 11 Jun 2019 04:35:22 GMT

@nawazns5038,

Take a look into below answer. Provide some sample data and explain what exactly the issue..

[https://answers.splunk.com/answers/124334/finding-the-field-difference-between-previous-event-and-current-event.html]

Thanks ..

Re: Searching for merged events in Splunk

amitm05 — Tue, 11 Jun 2019 11:21:50 GMT

Similar problem of merged events (not json though) will give you a good idea around the solution.
https://answers.splunk.com/answers/590914/need-some-help-with-event-breaks.html

Would be able to help more if you mention your sample events and the rules you have defined for them

Re: Searching for merged events in Splunk

nawazns5038 — Tue, 11 Jun 2019 19:14:29 GMT

    {
      "hello": "hello",
      "colors": {
        "red": "red",
        "blue": "blue",
        "green": "green"
      }
    }

    {
      "num_of_books": {
        "one": "1 book",
        "other": "%{count} books"
      }
    }

Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf .

I just want to know how many of these objects were merged instead of indexing into a single event,

how can we write a SPL query to identify the merged events.

Re: Searching for merged events in Splunk

nawazns5038 — Tue, 11 Jun 2019 19:14:44 GMT

    {
      "hello": "hello",
      "colors": {
        "red": "red",
        "blue": "blue",
        "green": "green"
      }
    }

    {
      "num_of_books": {
        "one": "1 book",
        "other": "%{count} books"
      }
    }

I just want to know how many of these objects were merged instead of indexing into a single event,

how can we write a SPL query to identify the merged events.

Re: Searching for merged events in Splunk

nawazns5038 — Wed, 12 Jun 2019 20:43:48 GMT

index=abcd | regex "}\n{"

The above query worked . It will search for merged events in JSON format.