How can I increase the interval of time between the arrival of events for proper line breaking?

[sunrise]

Hi Splunkers,

Considering delayed syslog data, I have tried the following scripts which output messages to the monitored file by Splunk.

echo -n "Mon Sep 22 17:18:22 2014 +80:00 SESSIONID: "155" ENTRYID: "7" STATEMENT: "7" " >> sample.log
sleep 3
echo "USERID: "GHOST" USERHOST: "Oracle10gR2_linux" TERMINAL: "pts/1" ACTION: "3" RETURNCODE: "0" OBJ$CREATOR: "SYS" OBJ$NAME: "DUAL" OS$USERID: "oracle"" >> sample.log

props.conf is following.

[sample]
LINE_BREAKER = ([\r\n]+)\w{3}\s+\w{3}\s+\d+\s+\d+\:\d+\:\d+\s+\d{4}
TIME_FORMAT = "%a %b %d %H:%M:%S %Y"

Among 0 to 3 seconds as a sleep command argument, Splunk indexed this sample.log properly and it came to be a single event.
However, from 4 seconds, Splunk indexed it as two events.

So I was wondering how to expand this interval?
If you know anything about it, please let me know.

[richgalloway · Accepted solution]

That would be governed by the time_before_close attribute in inputs.conf. The default value is 3 seconds which means Splunk will wait 3 seconds after reaching EOF for more events to arrive before forwarding/indexing them. Any events which arrive more than 3 seconds after Splunk reaches EOF will be treated as separate events.

[sunrise]

Thank you, richgalloway.
You're absolutely right.
Thank you very much for your help.

[richgalloway]

You're welcome. Please accept the answer.