While using print() to emit events from Python input, sometimes the events from separate print statements get merged. An example (edited) below:
2020-11-05T20:23:21.988802+00:00, application="application1"
2020-11-05T20:23:21.993878+00:00, application="application2"
I'm unclear why these particular ones got merged (there were other records print() -ed at 2020-11-05T20:23:21, and all events had increasing/unique timestamp)
Any pointers on how to prevent this? Thanks
The example looks like two separate events. How are they "merged"? What are the props.conf settings for that sourcetype?
sourcetype wasn't configured while above event was indexed
Configuring the sourcetype with SHOULD_LINEMERGE = false might not work well as events have multi-line fields