- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: What are possible causes of intermittent line ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to solve a problem where a particular JSON data feed/source has intermittent line break failures. In a 24 hour period, there are about 100K events parsed correctly (i.e., the line breaks are applied to the correct location) and about 40K events are parsed incorrectly (i.e., the 40K source/application events appear as 170 clumped events in Splunk). Hopefully that makes sense. My question: What are possible causes for this behavior?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This Q&A mentions an open support case that may be a genuine bug.
https://answers.splunk.com/answers/374017/why-are-events-getting-merged-around-midnight-afte.html
Other than that, the problem is usually that the user has redefined LINE_BREAKER and has SHOULD_LINEMERGE = true (<-incorrect) instead of SHOULD_LINEMERGE = false (<-correct).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This Q&A mentions an open support case that may be a genuine bug.
https://answers.splunk.com/answers/374017/why-are-events-getting-merged-around-midnight-afte.html
Other than that, the problem is usually that the user has redefined LINE_BREAKER and has SHOULD_LINEMERGE = true (<-incorrect) instead of SHOULD_LINEMERGE = false (<-correct).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We set SHOULD_LINEMERGE = "false" and that resolved the issue. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check for errors/warning in the _internal logs on Indexers for the sourcetype you're seeing issue.
index=_internal sourcetype=splunkd component=LineBreakProcessor log_level=error OR log_level=warn
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for this troubleshooting step.
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
Updated Team Landing Page in Splunk Observability
