Splunk Otel Multiline Configs

[dgill]

I'm using the splunk-otel-collector, and attempting to get multi-line java exceptions into a standardly formatted event. Using the example, my values file contains

     multilineConfigs:
        - namespaceName:
            value: example
            useRegexp: true
          firstEntryRegex: ^[^\s].*
          combineWith: ""

The rendered configMap contains

        - combine_field: attributes.log
          combine_with: ""
          id: example
          is_first_entry: (attributes.log) matches "^[^\\s].*"
          max_log_size: 1048576
          output: clean-up-log-record
          source_identifier: resource["com.splunk.source"]
          type: recombine

With that config, the logs continue to split . Then I change the value to

combineWith: "\t"

the following happens with the logs:

Screenshot 2024-10-08 at 2.36.59 PM.png

Has anyone experienced this and worked around it?

[PaulPanther]

If you use 

combineWith: "\t"

the log entries are correctly splitted or not?

Could you remove the combinedWith parameter from the config and deploy it again?