is there a way for Splunk forwarder to merge difference lines to one event?

[avivbaru]

Hello,

I just getting into Splunk and wondering if I can set the forwarder (maybe heavy forwarder) to merge different lines into one event.
The lines are not necessarily one after the other. I want to merge them by some unique Id.
Is it possible? Maybe not in the forwarder?
If it is not possible, What is the recommended way to handle this?

Thanks!

[richgalloway]

Adjacent lines can be merged using the right settings in props.conf, but that's only for heavy forwarders and indexers.
Merging non-adjacent lines at index time requires processing by a tool like Cribl or a custom script/utility. There are a few ways to merge events at search time.