How does Splunk calculate linecount?

[mloven_splunk]

I have logs that are linebreaking correctly, and are single line events, but the linecount is showing as "2".

I poked around in the original file and there seems to only be single line endings on each line (per vi :set list)

What does Splunk use to calculate linecount?

[mattymo]

Hello from the future!

I ran into this exact thing working with OpenTelemetry's HEC exporter. 

It turns out if the "raw" field contains a "\n" it will increment the linecount to 2. 

This is likely because Splunk's default line breaker behaviour is to drop any new lines as part of the capture group it uses "([\r\n]+)" so the logic assumes new lines would be removed.

so if it somehow sneaks into raw (in my case it skips linebreaking due to hec event endpoint)  even tho you dont see it in the raw even on screen it looks to trigger the linecount to be 2. 

[jplumsdaine22]

@mloven now that you work for Splunk did you get an answer? I'm seeing the same behavior

[cramasta]

Also seeing the same behavior where one line events are showing up at 2. Also only seeing single line endings when checking out the log on the forwarder host

[twistedsixty4]

I dont know if this answers your question, but you might find your answer here..
http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Indexmulti-lineevents