Getting Data In

Why does entering new line causes multiple events?

jkim34
New Member

In the web form application, when new line is inserted (by hitting Enter key) in text area, it logs through Logger Factory, and gets sent over to Splunk Cloud. I've realized that this causes multiple events (per new line) instead of one single event.
It is logged in one single statement, however.

LOGGER.info(form.toString());

Is this default behavior? And is there way to make it single event?

0 Karma

nickhills
Ultra Champion

Can you post a log example (sanitised if need be) which shows what the event should look like?

If my comment helps, please give it a thumbs up!
0 Karma

mayurr98
Super Champion

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking for all the details.

0 Karma

jkim34
New Member

Hi mayurr98,

I appreciate for the feedback. I know for sure that it isn't 256 characters per event, as event gets created even with few characters. However, I agree that it may be way props.conf is configured. I'll look to see what is going on. Thanks!

0 Karma

mayurr98
Super Champion

yes sure check and let me know ! I may be wrong

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...