How to merge lines based on timestamps?

[thompsonsgg]

Attached is a screenshot of the way my logs are appearing in Splunk. They match the log files themselves exactly, separating out each entry regardless of the timestamp. The pattern is the same for each new event (INFO | JVM1...) and we want to try to “linemerge” events that have the same exact timestamps (Examples hightlighted).

How would I approach this issue?

Thanks!

[yannK]

At search time, try the transaction command.

Or use the poor man transaction " ... | stats values(_raw) by source sourcetype host index _time "

[richgalloway]

Do you want to merge them at index time or search time?

[Avantika]

@richgalloway How to do it during index time? What changes need to be made in line break settings?

[richgalloway]

You may be able to adjust the props.conf settings to change how events are ingested.  Can you share raw events?