Getting Data In

How do I configure Splunk to prevent 3 separate events from being merged as a single event?

athorat
Communicator

When I search on one of the indexes, I get the data in a single event.
It should be three separate events. How can we deal with it?

Event returned in Splunk:

maintainCSAAContract,maintainCSAAContract,SOAUSER,,,479244912373535201,0,,9,2015-12-02 23:22:15.35,2015-12-02 23:22:15.709,359,,,,2,89501422,87549234,,,,67,121154630,5849501,,,,,, validateCSAAContractPartyRole,validateCSAAContractPartyRole,SOAUSER,Realtime,,973244912373550901,300,31696,0,2015-12-02 23:22:15.507,2015-12-02 23:22:15.766,259,,,,,,,,,,13,215066973,85403412,,,,,, maintainCSAAContractRoleIdentifier,maintainCSAAContractRoleIdentifier,TestUser,PROFILE_INSERT_UPDATE,,339944912373599301,300,1698,0,2015-12-02 23:22:15.992,2015-12-02 23:22:16.293,301,2,14557745,12844709,,,,,,,38,122412057,20411825,,,,,,

This should be 3 separate events

Event 1:

maintainCSAAContract,maintainCSAAContract,SOAUSER,,,479244912373535201,0,,9,2015-12-02 23:22:15.35,2015-12-02 23:22:15.709,359,,,,2,89501422,87549234,,,,67,121154630,5849501,,,,,,

Event 2:

validateCSAAContractPartyRole,validateCSAAContractPartyRole,SOAUSER,Realtime,,973244912373550901,300,31696,0,2015-12-02 23:22:15.507,2015-12-02 23:22:15.766,259,,,,,,,,,,13,215066973,85403412,,,,,,

Event 3:

maintainCSAAContractRoleIdentifier,maintainCSAAContractRoleIdentifier,TestUser,PROFILE_INSERT_UPDATE,,339944912373599301,300,1698,0,2015-12-02 23:22:15.992,2015-12-02 23:22:16.293,301,2,14557745,12844709,,,,,,,38,122412057,20411825,,,,,,
Tags (1)
0 Karma

renjith_nair
Legend

use LINE_BREAKER = to break your lines if it does not have default line breaking based on timestamp and new line.

Refer to http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Indexmulti-lineevents for details

---
What goes around comes around. If it helps, hit it with Karma 🙂

sundareshr
Legend

how are the events in the log file? Are these in separate lines? In other words, each event in a separate line? What's in your props.conf

Try adding the following to your props.conf
SHOULD_LINEMERGE = false

0 Karma

athorat
Communicator

Thanks for the suggestion, but that did not work.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...