Why is linecount 2 when it's clearly 1?

[danielbb]

For multiple sourcetypes, linecount is 2, while clearly, it should be 1. Has anybody encountered this case?

[livehybrid]

Hi @danielbb 

Please could you share a sample event and screenshot of this so we try and repeat this issue and/or diagnose?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[danielbb]

Thank you, @livehybrid, @richgalloway, I'll get screenshots but, a related question, how do I access the second line of _raw?

[isoutamo]

In splunk _raw is only one line, but it can contains e.g. \n character.
You could see it e.g. “table _raw”

[danielbb]

@isoutamo  I'm running the following - 

index = <my_index> linecount=2
| table _raw 

and everything shows up as one line, I don't see any sign of \n, what do I miss? 

I also checked with an encoding tool and it doesn't show either the 13 ascii code or the 10 one within these lines. 

My biggest confusion is the fact that for this sourcetype I have -  

SHOULD_LINEMERGE=FALSE

And therefore, how come, sometimes the events have multiple lines? 

[isoutamo]

Hoe you have defined line breaking?

[danielbb]

I came across an identical thread at Re: How does Splunk calculate linecount? - Splunk Community

[livehybrid]

Hi @danielbb 

It could be something like a field extraction happening after the line breaking which is causing this, or something else. Without access to your instance we could do with seeing some sample logs along with a btool output ($SPLUNK_HOME/bin/splunk btool props list <sourceTypeName>) for your event's sourcetype. 

The thread you posted from 2013 looks like could have been related to the events having a line-break in.

Please let us know if you're able to provide a sample + props output. 

Thanks

[richgalloway]

Example?  Screenshot?