I'm trying to create an event break for an Oracle sql query I created in Splunk DB connect
the oracle query generates multiple rows that I would like to consolidate into a single event.
The delimiter is "||" characters that I appended as the last row in the query.
I configured the source type settings as follows:
BREAK_ONLY_BEFORE = ||
SHOULD_LINEMERGE = true
As part of creating the input, I selected current index time as the timestamp.
However, Splunk is creating separate events for each row in the query instead of merging the results into a single event based on the delimiter.
I've tried generating the "II" row at both the beginning and end of the query.
Any suggestions?
Thanks in Advance.
It’s best practice to use a LINE_BREAKER instead.
Try this:
[yourSourcetype]
...
SHOULD_LINEMERGE = 0
LINE_BREAKER = (\|\|)
You’ll have to re index the data to see the results.
I'm pretty sure that | behaves as a character with special meaning in regex (| = OR).
Please try escaping them, as this:
||