Getting Data In

SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true defaults

dglass0215
Path Finder

Hello,

i am trying to understand the documentation surrounding SHOULD_LINEMERGE. It says the default is SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true. If my understanding is correct this means that if a logfile has multiple lines, the multiple lines will be part of one event that is indexed up until the next date/timestamp is found and then that would be another event.

I have a logfile with the following two lines:

2019-12-30 09:16:41:908: Requestor: IMM_Mobile, IsLocal: False
2019-12-30 09:16:41:908: 637132942019089151: Scanned CID: BARCODE:

However, they get indexed as one event and this is not what I want. A previous suggestion to me was to make SHOULD_LINEMERGE = false, however I do not think I want to do that because there are certain entries in the logfile that do span multiple lines.

Any assistance is greatly appreciated!
David

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your understanding of those two settings is correct. It's important, however, to define what constitutes a date. Add TIME_FORMAT = %Y-%m-%d %H:%M:%S:%3N to the appropriate props.conf file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your understanding of those two settings is correct. It's important, however, to define what constitutes a date. Add TIME_FORMAT = %Y-%m-%d %H:%M:%S:%3N to the appropriate props.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dglass0215
Path Finder

Thanks! So far so good. I have not seen an incorrect merging of lines since I added TIME_FORMAT. Will keep monitoring and will mark this as the answer soon.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...