Getting Data In

How to merge lines based on timestamps?

New Member

Attached is a screenshot of the way my logs are appearing in Splunk. They match the log files themselves exactly, separating out each entry regardless of the timestamp. The pattern is the same for each new event (INFO | JVM1...) and we want to try to “linemerge” events that have the same exact timestamps (Examples hightlighted).

How would I approach this issue?

Thanks!

alt text

0 Karma

Splunk Employee
Splunk Employee

At search time, try the transaction command.

Or use the poor man transaction " ... | stats values(_raw) by source sourcetype host index _time "

SplunkTrust
SplunkTrust

Do you want to merge them at index time or search time?

---
If this reply helps you, an upvote would be appreciated.
0 Karma