Deployment Architecture

is there a way for Splunk forwarder to merge difference lines to one event?

avivbaru
Engager

Hello,

I just getting into Splunk and wondering if I can set the forwarder (maybe heavy forwarder) to merge different lines into one event.
The lines are not necessarily one after the other. I want to merge them by some unique Id.
Is it possible? Maybe not in the forwarder?
If it is not possible, What is the recommended way to handle this?

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Adjacent lines can be merged using the right settings in props.conf, but that's only for heavy forwarders and indexers.
Merging non-adjacent lines at index time requires processing by a tool like Cribl or a custom script/utility. There are a few ways to merge events at search time.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...