I have a log source for LDAP that includes a mix of single line events and multiline events. The multiline events look something like:
Authentication request received from ip=x.x.x.x
Connecting to LDAP server "y.y.y.y"
Mapped uid=5401 to user 'joe'
Submitting authentication request
Authentication success for user 'joe'
My props.conf file has:
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Authentication request received
MUST_BREAK_AFTER = Authentication success
When I do this, the "Authentication success" event always ends up in its own event. When I look at the timestamps, I see that there is usually a 3-10 second delay between the timestamp on the "Submitting authentication request" message and the "Authentication success" message.
Is there a setting that controls how long Splunk will tolerate a delay in messages before deciding to move on from the line breaking process? Any ideas on what the issue might be?
Thx.
