Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Combining events into one
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We're experiencing a problem with having indexed data with the default MAX_EVENTS value of 256. While this can be fixed in the configuration for new events, is there any way of combining e.g. a java stack trace of say 2000+ lines, which has been split up into tens of events, when searching?
Since we have already indexed a whole lot of logs, I'd hate to re-index it all again.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
echalex,
Unfortunately, If you have indexed data based on non-optimal or incorrect line breaking, there is not much that can be done via search to reliably reconstruct your data. You may be able to use the "transaction" command to create a single event as long as each event matches the criteria you are using to build the transaction.
For instance if you wanted to create a single event from multiple events from the same source, same time, and had some type of additional identifier like java_id:
| transaction _time,source,java_id
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
echalex,
Unfortunately, If you have indexed data based on non-optimal or incorrect line breaking, there is not much that can be done via search to reliably reconstruct your data. You may be able to use the "transaction" command to create a single event as long as each event matches the criteria you are using to build the transaction.
For instance if you wanted to create a single event from multiple events from the same source, same time, and had some type of additional identifier like java_id:
| transaction _time,source,java_id
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I noticed I hadn't thanked you for the informative answer.
So thank you. 🙂 (Better late than never, eh?)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Make Your Machine Data AI-Ready in Splunk
Splunk Asynchronous Forwarding Explained
How to Monitor AI Agents with Splunk Agent Observability
