topic Re: entire file to a single event in Splunk Search

entire file to a single event

722624 — Tue, 29 Sep 2020 14:52:27 GMT

SHOULD_LINEMERGE = true
MAX_EVENTS = 99999
TRUNCATE = 9999999

SHOULD_LINEMERGE = false
LINE_BREAKER = ((FAIL*))

I have tried both of above (trying each one at a time) in indexer props.conf ...and restarted splunk..to have a simple text file , entire file to go to single event but whatever I do splunk automatically splitting the file into 2 events
Is there any way to have the entire file to single event

Thank you in advance
AB

Re: entire file to a single event

bic — Fri, 14 Jul 2017 08:59:37 GMT

in the LINE_BREAKER you can use regular expression to match end of file , something like (.*?) . Hope that should not break your file into two parts

Re: entire file to a single event

722624 — Tue, 29 Sep 2020 14:53:00 GMT

[sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (.*?)

I tried the above... still file is split into two events....the same regex (.*?) in regex101.com is selecting the entire file

Thank you
AB

Re: entire file to a single event

bic — Mon, 17 Jul 2017 05:39:34 GMT

SHOULD_LINEMERGE= TRUE, try with that

Re: entire file to a single event

722624 — Tue, 29 Sep 2020 14:53:03 GMT

Actually documentation asked to have SHOULD_LINEMERGE= false for LINE_BREAKER ...
anyways tried your suggestion also ...
No Luck 😞

Thank you
AB

Re: entire file to a single event

722624 — Mon, 17 Jul 2017 07:44:13 GMT

surprisingly...If i download the file to my PC and upload with same source type then it is reading entire file as single event....
But if the same log file is coming from forwarder, then file is being split into 2 event...

Anybody? please help

Thank you
AB

Re: entire file to a single event

bic — Mon, 17 Jul 2017 07:48:33 GMT

please check the queue size from the forwarder , try indexing a smaller file and see if that is coming through in one piece

Re: entire file to a single event

722624 — Mon, 17 Jul 2017 08:07:47 GMT

this file is 90 lines only hardly 4kb in size....