How do I configure Ironstream and/or Splunk to treat events individually, rather than aggregating events by time?
I'm sending many events per second to Splunk via Ironstream, and often there are 3 or more events getting indexed as one event.
I always tell our customers to use the following parameters in their props.conf file for sourcetype=syncsortMF
SHOULD_LINEMERGE = false
LINE_BREAKER = \"}$
You probably need to set the line-breaking rules for the data in props.conf
If each event is a single line, the only setting that you probably need is
SHOULD_LINEMERGE = false
For more detailed help from the Answers community, we need to see a sample of the data stream (obfuscated of course).
You can also read more about this in the documentation: Configure event line breaking