When I search on one of the indexes, I get the data in a single event.
It should be three separate events. How can we deal with it?
Event returned in Splunk:
maintainCSAAContract,maintainCSAAContract,SOAUSER,,,479244912373535201,0,,9,2015-12-02 23:22:15.35,2015-12-02 23:22:15.709,359,,,,2,89501422,87549234,,,,67,121154630,5849501,,,,,, validateCSAAContractPartyRole,validateCSAAContractPartyRole,SOAUSER,Realtime,,973244912373550901,300,31696,0,2015-12-02 23:22:15.507,2015-12-02 23:22:15.766,259,,,,,,,,,,13,215066973,85403412,,,,,, maintainCSAAContractRoleIdentifier,maintainCSAAContractRoleIdentifier,TestUser,PROFILE_INSERT_UPDATE,,339944912373599301,300,1698,0,2015-12-02 23:22:15.992,2015-12-02 23:22:16.293,301,2,14557745,12844709,,,,,,,38,122412057,20411825,,,,,,
This should be 3 separate events
Event 1:
maintainCSAAContract,maintainCSAAContract,SOAUSER,,,479244912373535201,0,,9,2015-12-02 23:22:15.35,2015-12-02 23:22:15.709,359,,,,2,89501422,87549234,,,,67,121154630,5849501,,,,,,
Event 2:
validateCSAAContractPartyRole,validateCSAAContractPartyRole,SOAUSER,Realtime,,973244912373550901,300,31696,0,2015-12-02 23:22:15.507,2015-12-02 23:22:15.766,259,,,,,,,,,,13,215066973,85403412,,,,,,
Event 3:
maintainCSAAContractRoleIdentifier,maintainCSAAContractRoleIdentifier,TestUser,PROFILE_INSERT_UPDATE,,339944912373599301,300,1698,0,2015-12-02 23:22:15.992,2015-12-02 23:22:16.293,301,2,14557745,12844709,,,,,,,38,122412057,20411825,,,,,,
use LINE_BREAKER = to break your lines if it does not have default line breaking based on timestamp and new line.
Refer to http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Indexmulti-lineevents for details
how are the events in the log file? Are these in separate lines? In other words, each event in a separate line? What's in your props.conf
Try adding the following to your props.conf
SHOULD_LINEMERGE = false
Thanks for the suggestion, but that did not work.