topic Splunk GUI seperating event in Splunk Search

Splunk GUI seperating event

Komal0113 — Wed, 01 Nov 2023 07:04:10 GMT

From splunk user we are receiving logs but when it comes to Splunk search head its splitting into different events

Expected log :

Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70 # Succeeded # Function:[Configuration Management][MML Command] PQR ME:; # 2023-10-26 09:37:51#

splunk dividing into two separate events

Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70 # Succeeded # Function:[Configuration Management][MML Command]

LST ME:; # 2023-10-26 09:37:51#

How can i resolve this cannot combine this two because getting seperate event not one after another

Re: Splunk GUI seperating event

inventsekar — Wed, 01 Nov 2023 07:26:56 GMT

Hi @Komal0113 Some more details needed:

Can we have your Splunk Search Query pls (remove any hostname, ip address, etc from the search query)
Are you using HF or not
mostly the props/transforms causes this issue. can we have your props/transforms(only the portion responsible for this APP/add-on/TA is enough)

Re: Splunk GUI seperating event

Komal0113 — Wed, 01 Nov 2023 11:55:03 GMT

Hi @inventsekar

1) In splunk search query we are using index name for search

2) Receiving logs via udp port

3) props conf

LINE_BREAKER = (\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}) SHOULD_LINEMERGE = false

Re: Splunk GUI seperating event

PickleRick — Wed, 01 Nov 2023 08:07:46 GMT

1. Search head is the component which spawns searches against indexers which hold the already indexed data. So I assume you meant that you're sending data in some format but it's getting improperly split into events.

2. Sending raw tcp or udp data stream directly to a Splunk component is not the preferred way to go (for several reasons which I will not dig into at this point).

3. What do these events look like on the wire? I'm not 100% sure but I think they might get split at datagram boundary regardless of other settings.

4. Your "split" set of events contains a second event which is _not_a part of the original event. A typo in preparation of the mockup data?