have a scripted input that runs:
netstat -tupn and the output shows:
tcp x.x.x.x:38314 x.x.x.x:7075 ESTABLISHED 4144/java
tcp x.x.x.x:22 x.x.x.x:62601 ESTABLISHED 5830/sshd:
tcp x.x.x.x:37032 x.x.x.x:8080 ESTABLISHED 4144/java
tcp x.x.x.x:59344 x.x.x.x:49302 ESTABLISHED 4144/java
in my props.conf I have
[<sourcetype>]
BREAK_ONLY_BEFORE = (tcp)
SHOULD_LINEMERGE = false
the events are getting indexed but I only see the first event
tcp x.x.x.x:38314 x.x.x.x:7075 ESTABLISHED 4144/java
and nothing else gets indexed. What am I missing?
Change SHOULD_LINEMERGE = True
Why is that? I thought LINEMERGE meant taking individual events and making them 1 single event? I have a multi line event that I want to be single events. Am I miss understanding that line?