Getting Data In

How to merge lines based on timestamps?

thompsonsgg
New Member

Attached is a screenshot of the way my logs are appearing in Splunk. They match the log files themselves exactly, separating out each entry regardless of the timestamp. The pattern is the same for each new event (INFO | JVM1...) and we want to try to “linemerge” events that have the same exact timestamps (Examples hightlighted).

How would I approach this issue?

Thanks!

alt text

0 Karma

yannK
Splunk Employee
Splunk Employee

At search time, try the transaction command.

Or use the poor man transaction " ... | stats values(_raw) by source sourcetype host index _time "

richgalloway
SplunkTrust
SplunkTrust

Do you want to merge them at index time or search time?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Avantika
New Member

@richgalloway How to do it during index time? What changes need to be made in line break settings?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You may be able to adjust the props.conf settings to change how events are ingested.  Can you share raw events?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...