There is an application putting SOAP logs, request and response, in a small delay of 0 ~10 secs into the log file - I want this to be indexed as a single event, but Splunk indexes it into 2 events - request and response separately. This doesn't always happen, but quite frequently. How can I achieve this?
This is not what Splunk can support. In order to get data indexed in a timely way, we presume an event is complete IF:
- The last character of the file is a newline
- The size of the file is not a multiple of 512 bytes
So if your app writes out a complete line and the stops, Splunk will break it.
Hello,
To do this put the following 2 lines in forwarder's props.conf:
SHOULD_LINEMERGE=true
MAX_EVENTS = 2
Regards,
Ahmed Elakwah
This is not what Splunk can support. In order to get data indexed in a timely way, we presume an event is complete IF:
- The last character of the file is a newline
- The size of the file is not a multiple of 512 bytes
So if your app writes out a complete line and the stops, Splunk will break it.
If there's a gap more than 3 seconds between each data flush, either by app or by OS the event will be indexed separately because of this behavior. To work around it increase the value of time_before_close to, like 10 secs.
[monitor://D:\LogFiles\Test]
time_before_close = 10