Getting Data In

Line Breaking for netstat only breaks on the first line

ekenne06
Path Finder

have a scripted input that runs:

netstat -tupn and the output shows:

 
 
 

tcp x.x.x.x:38314 x.x.x.x:7075 ESTABLISHED 4144/java

tcp x.x.x.x:22 x.x.x.x:62601 ESTABLISHED 5830/sshd:

tcp x.x.x.x:37032 x.x.x.x:8080 ESTABLISHED 4144/java

tcp x.x.x.x:59344 x.x.x.x:49302 ESTABLISHED 4144/java 

 

in my props.conf I have 

[<sourcetype>]

BREAK_ONLY_BEFORE = (tcp)

SHOULD_LINEMERGE = false

the events are getting indexed but I only see the first event

tcp x.x.x.x:38314 x.x.x.x:7075 ESTABLISHED 4144/java

and nothing else gets indexed. What am I missing?

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Change SHOULD_LINEMERGE = True

 

————————————
If this helps, give a like below.
0 Karma

ekenne06
Path Finder

Why is that? I thought LINEMERGE meant taking individual events and making them 1 single event? I have a multi line event that I want to be single events. Am I miss understanding that line? 

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...