Getting Data In

What are possible causes of intermittent line break failures?

6c6f6c
Engager

I am trying to solve a problem where a particular JSON data feed/source has intermittent line break failures. In a 24 hour period, there are about 100K events parsed correctly (i.e., the line breaks are applied to the correct location) and about 40K events are parsed incorrectly (i.e., the 40K source/application events appear as 170 clumped events in Splunk). Hopefully that makes sense. My question: What are possible causes for this behavior?

0 Karma
1 Solution

woodcock
Esteemed Legend

This Q&A mentions an open support case that may be a genuine bug.

https://answers.splunk.com/answers/374017/why-are-events-getting-merged-around-midnight-afte.html

Other than that, the problem is usually that the user has redefined LINE_BREAKER and has SHOULD_LINEMERGE = true (<-incorrect) instead of SHOULD_LINEMERGE = false (<-correct).

View solution in original post

woodcock
Esteemed Legend

This Q&A mentions an open support case that may be a genuine bug.

https://answers.splunk.com/answers/374017/why-are-events-getting-merged-around-midnight-afte.html

Other than that, the problem is usually that the user has redefined LINE_BREAKER and has SHOULD_LINEMERGE = true (<-incorrect) instead of SHOULD_LINEMERGE = false (<-correct).

6c6f6c
Engager

We set SHOULD_LINEMERGE = "false" and that resolved the issue. Thanks!

0 Karma

somesoni2
Revered Legend

Check for errors/warning in the _internal logs on Indexers for the sourcetype you're seeing issue.

index=_internal sourcetype=splunkd component=LineBreakProcessor log_level=error OR log_level=warn
0 Karma

6c6f6c
Engager

Thanks for this troubleshooting step.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...