Group events by _time while indexing

[sivaranjiniG]

I have logs with same _time(msg field) like below

type=CWD msg=audit(1631697722.980:2773):  cwd="/"
type=PATH msg=audit(1631697722.980:2773): item=0 name="/bin/bash" inode=12593039 
type=PATH msg=audit(1631697722.980:2773): item=1 ouid=0 ogid=0 rdev=00:00 
type=PROCTITLE msg=audit(1631697722.980:2773): proctitle=2F62696E2F626E2F6C6F67726F74617E66

 While indexing i want events to be grouped by _time (taking above example, instead of having 4 events i want one single events with all the type). I used SHOULD_LINEMERGE = true but its not working 

Please someone help me with this..

[PickleRick]

Short answer is don't do that.

Longer answer is - I recognize auditd logs and these are indeed four different events (they are independently emmited by auditd). Yes, they may be related to a single user's operation (for example - launching a new process), but they come from four different auditd rule actions. You should keep them as separate events and you can use transactions of other forms of search-time trickery to group them when searching.

[richgalloway]

Splunk doesn't really group events on ingest.  Instead, it uses various rules to determine what separates one event from the next.  If you can tell us where one event stop and the next begins (perhaps "type=CMD" ?) that would help.