How to merge lines based on timestamps?

[thompsonsgg]

Attached is a screenshot of the way my logs are appearing in Splunk. They match the log files themselves exactly, separating out each entry regardless of the timestamp. The pattern is the same for each new event (INFO | JVM1...) and we want to try to “linemerge” events that have the same exact timestamps (Examples hightlighted).

How would I approach this issue?

Thanks!

[yannK]

At search time, try the transaction command.

Or use the poor man transaction " ... | stats values(_raw) by source sourcetype host index _time "

[richgalloway]

Do you want to merge them at index time or search time?