Getting Data In

Multiple Cloudwatch logs are coming into Splunk as one event


I have set up logging AWS cloudwatch to Splunk using the firehose method from this Blog:

Most of the time it comes in as a nice clean JSON log but sometimes multiple logs come in as one event.
Is there a way to prevent this?

Can this be done in my lambda? Prefer to do in lambda since I'm in a managed cloud.
Or do I have to do line break in props.conf ?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!