Splunk Search

How do you Join or Merge multiple events at index time based on a common field?

ncmouli
New Member

I'm looking for a method to merge events based on a common field at index time, not at search time, and I've have already used LINE_BREAKER in props.conf to join the events with regex pattern of events. However, it does not seem to be working only if the events being ingested with delay.

Can someone please suggest if any supported attribute like LINE_BREAKER in Props or any other alternative which helps us to join the events though ingested with delay.

Thanks much for your response!

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi there, can you please share some sample events (remove all private informations first!) and the expected result? Without these information it will be very difficult to provide help.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...