events print()-ed from Python input merged

[gliptak]

While using print() to emit events from Python input, sometimes the events from separate print statements get merged. An example (edited) below:

2020-11-05T20:23:21.988802+00:00, application="application1"
2020-11-05T20:23:21.993878+00:00, application="application2"

I'm unclear why these particular ones got merged (there were other records print() -ed at 2020-11-05T20:23:21, and all events had increasing/unique timestamp)

Any pointers on how to prevent this? Thanks

[richgalloway]

The example looks like two separate events.  How are they "merged"?  What are the props.conf settings for that sourcetype?

[gliptak]

events.png

sourcetype wasn't configured while above event was indexed

Configuring the sourcetype with SHOULD_LINEMERGE = false might not work well as events have multi-line fields