Splunk Search

How to merge multiple events into single events?

kannu
Communicator

Hello Splunkers,

I have one file whose starting line can be anything but that file ends with "Completed Backup" line. So currently the contents of the file are getting indexed line by line based on time. But I want the full content of the file from starting of file till "Completed Backup" in a single event.

I have checked LINE_BREAKER and SHOULD_LINEMERGE settings but didn't get the confidence on using these settings.

Please help me

Warm regards

0 Karma
1 Solution

somesoni2
Revered Legend

If you want the entire file content, regardless of how it starts, to a single events, you need to setup a LINE_BREAKER to something which will never be found on the log file.
Give this a try

[yourSourceType]
SHOULD_LINEMERGE =false
LINE_BREAKER = (MaryHadALittleLamb)
#Set below two attribute to values high enough to hold all your file content
TRUNCATE = 99999
MAX_EVENTS =1000

View solution in original post

somesoni2
Revered Legend

If you want the entire file content, regardless of how it starts, to a single events, you need to setup a LINE_BREAKER to something which will never be found on the log file.
Give this a try

[yourSourceType]
SHOULD_LINEMERGE =false
LINE_BREAKER = (MaryHadALittleLamb)
#Set below two attribute to values high enough to hold all your file content
TRUNCATE = 99999
MAX_EVENTS =1000

View solution in original post

kannu
Communicator

where i need to mention in the UF props.conf or Indexer Props.conf

0 Karma

somesoni2
Revered Legend

This should be in indexer or heavy forwarder, whichever comes fast.

0 Karma

kannu
Communicator

@somesoni2 , where i need to mention in the UF props.conf or Indexer Props.conf

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!