Is there any configuration/way to merge two or more events into one ?

[neelpatel02]

I was trying to send data through Splunk HEC (Http event Collector).

curl http://ip:8088/services/collector -H "Authorization: Splunk <HEC_TOKEN>" -d '{"event": "Test1"}{"event": "Test2"}{"event": "Test3"}'

So,  in splunk it will goes like

Test1 (-> Event 1)

Test2 (-> Event 2)

Test3 (-> Event 3)

Result I want:

Test1Test2Test3  (as 1 event in splunk.)

[yuanliu]

What you wanted is expressed as an array in JSON.

curl http://ip:8088/services/collector -H "Authorization: Splunk <HEC_TOKEN>" -d '[{"event": "Test1"},{"event": "Test2"}m{"event": "Test3"}]'