merging as single event from mutlple lines

[roopeshetty]

Hi Guys,

We are collecting the Kubernetes logs using HEC on our Cloud splunk. When ever there is a ERROR entry in the logs , it will have a timestamp in the first line and later lines will be logged as below one after one which will have a information about that error.

But when we see it in Splunk console these lines will be splitted as multiple events as below which is leading to confusion.

Is there anyway we can merge these particular lines as single events so that all lines related to any error should be visible as a single event. Please help on this.

[PickleRick]

There is no such thing as "merging" events.

If you're sending to the /event endpoint, you have to make sure you're sending whole events. I'm not 100% how/if linebreaking works with /raw endpoint.