I'm trying to create an event break for a query I created in Splunk DB connect

[pc1234]

I'm trying to create an event break for an Oracle sql query I created in Splunk DB connect
the oracle query generates multiple rows that I would like to consolidate into a single event.
The delimiter is "||" characters that I appended as the last row in the query.
I configured the source type settings as follows:

BREAK_ONLY_BEFORE = ||
SHOULD_LINEMERGE = true
As part of creating the input, I selected current index time as the timestamp.

However, Splunk is creating separate events for each row in the query instead of merging the results into a single event based on the delimiter.

I've tried generating the "II" row at both the beginning and end of the query.

Any suggestions?

Thanks in Advance.

[jkat54]

It’s best practice to use a LINE_BREAKER instead.

Try this:

[yourSourcetype]
...
SHOULD_LINEMERGE = 0
LINE_BREAKER = (\|\|)

You’ll have to re index the data to see the results.

[xpac]

I'm pretty sure that | behaves as a character with special meaning in regex (| = OR).
Please try escaping them, as this:
||