All Apps and Add-ons

I'm trying to create an event break for a query I created in Splunk DB connect

pc1234
Engager

I'm trying to create an event break for an Oracle sql query I created in Splunk DB connect
the oracle query generates multiple rows that I would like to consolidate into a single event.
The delimiter is "||" characters that I appended as the last row in the query.
I configured the source type settings as follows:

BREAK_ONLY_BEFORE = ||
SHOULD_LINEMERGE = true
As part of creating the input, I selected current index time as the timestamp.

However, Splunk is creating separate events for each row in the query instead of merging the results into a single event based on the delimiter.

I've tried generating the "II" row at both the beginning and end of the query.

Any suggestions?

Thanks in Advance.

0 Karma

jkat54
SplunkTrust
SplunkTrust

It’s best practice to use a LINE_BREAKER instead.

Try this:

[yourSourcetype]
...
SHOULD_LINEMERGE = 0
LINE_BREAKER = (\|\|)

You’ll have to re index the data to see the results.

xpac
SplunkTrust
SplunkTrust

I'm pretty sure that | behaves as a character with special meaning in regex (| = OR).
Please try escaping them, as this:
||

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...