Combining events into one

[echalex]

We're experiencing a problem with having indexed data with the default MAX_EVENTS value of 256. While this can be fixed in the configuration for new events, is there any way of combining e.g. a java stack trace of say 2000+ lines, which has been split up into tens of events, when searching?

Since we have already indexed a whole lot of logs, I'd hate to re-index it all again.

[hazekamp · Accepted solution]

echalex,

Unfortunately, If you have indexed data based on non-optimal or incorrect line breaking, there is not much that can be done via search to reliably reconstruct your data. You may be able to use the "transaction" command to create a single event as long as each event matches the criteria you are using to build the transaction.

For instance if you wanted to create a single event from multiple events from the same source, same time, and had some type of additional identifier like java_id:

| transaction _time,source,java_id 

[echalex]

I noticed I hadn't thanked you for the informative answer.
So thank you. 🙂 (Better late than never, eh?)

[merugu448]

Thank you!!