Getting Data In

What are possible causes of intermittent line break failures?

6c6f6c
Engager

I am trying to solve a problem where a particular JSON data feed/source has intermittent line break failures. In a 24 hour period, there are about 100K events parsed correctly (i.e., the line breaks are applied to the correct location) and about 40K events are parsed incorrectly (i.e., the 40K source/application events appear as 170 clumped events in Splunk). Hopefully that makes sense. My question: What are possible causes for this behavior?

0 Karma
1 Solution

woodcock
Esteemed Legend

This Q&A mentions an open support case that may be a genuine bug.

https://answers.splunk.com/answers/374017/why-are-events-getting-merged-around-midnight-afte.html

Other than that, the problem is usually that the user has redefined LINE_BREAKER and has SHOULD_LINEMERGE = true (<-incorrect) instead of SHOULD_LINEMERGE = false (<-correct).

View solution in original post

woodcock
Esteemed Legend

This Q&A mentions an open support case that may be a genuine bug.

https://answers.splunk.com/answers/374017/why-are-events-getting-merged-around-midnight-afte.html

Other than that, the problem is usually that the user has redefined LINE_BREAKER and has SHOULD_LINEMERGE = true (<-incorrect) instead of SHOULD_LINEMERGE = false (<-correct).

6c6f6c
Engager

We set SHOULD_LINEMERGE = "false" and that resolved the issue. Thanks!

0 Karma

somesoni2
Revered Legend

Check for errors/warning in the _internal logs on Indexers for the sourcetype you're seeing issue.

index=_internal sourcetype=splunkd component=LineBreakProcessor log_level=error OR log_level=warn
0 Karma

6c6f6c
Engager

Thanks for this troubleshooting step.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...