Getting Data In

Multiple Cloudwatch logs are coming into Splunk as one event

bobmccoy
Explorer

I have set up logging AWS cloudwatch to Splunk using the firehose method from this Blog:
https://www.splunk.com/blog/2019/02/21/how-to-ingest-any-log-from-aws-cloudwatch-logs-via-firehose.h...

Most of the time it comes in as a nice clean JSON log but sometimes multiple logs come in as one event.
Is there a way to prevent this?

Can this be done in my lambda? Prefer to do in lambda since I'm in a managed cloud.
Or do I have to do line break in props.conf ?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!