Alert Manager: How to prevent long comments (with new line) from being split into multiple events?

[americob]

While testing comments, I've found that when we entered a long comment (copied a 219 word / 2 paragraph text fromhttp://lipsum.com/feed/html ) they are split into 3 events. The first event has the fields time, serverity, origin, event_id, user, action, incident_id, comment. The comment is split so the second paragraph is located in a second event (no fields) and the 3rd event has only the closing quotes.

Thanks,
Americo

[Simon]

Thanks for the report. I confirm that this is a bug. I'll have a look and provide a workaround and a solution in the source code.
By the way, I opened a bug report at GitHub:
https://github.com/simcen/alert_manager/issues/131

[mtranchita]

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking#Merge_multiple_lin...

[Azeemering · Accepted solution]

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Indexmulti-lineevents for all the details.