Searching a single line at a time

[anirbanukil]

My Search query:

source="test source" "AggCd" AND  "test2# " AND "TransTypeCd " AND (NOT ("test2# null")) | rex "test2# (?<test_no>\d+),"| where (!isnum(test_no))

Search result (5 lines being returned):

[11/28/11 0:59:57:958 EST] 000027ad SystemOut     O AggCd , RqUID 2011-11-28T00:59:57-05:0033999785, test# 20412042, TransTypeCd PE, SubTransTypeCd , Term CURRENT, Status 00

[11/28/11 0:59:57:973 EST] 000027b4 SystemOut     O AggCd , RqUID 70485b0a-42f8-99f2-efd78929db9f, test2# 6759 !47, TransTypeCd RQ, 

[11/28/11 0:59:57:977 EST] 000027b4 SystemOut     O AggCd , RqUID 7048ab0a-42f8-99f2-efd78929db9f, TransTypeCd RQ, MAILER 15 ms

[11/28/11 0:59:58:006 EST] 000027b0 SystemOut     O Host requesting current state inquiry on 

[11/28/11 0:59:58:017 EST] 000027b4 SystemOut     O AggCd , RqUID 7048546-42f8-99f2-efd78929db9f, TransTypeCd RQ,  

Question:

I want to search for one line at a time not a collection of indexed lines.
I don't want to change SHOULD_LINEMERGE to "false" in props.conf (default is true).

[woodcock]

Your linebreaking is broken and there is no sense talking about using your events as-is: you need to fix your events first. Read this (do NOT skim it) and act accordingly:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents

[anirbanukil]

You are partly right.
I am getting multiple events as the Search result when the Search is executed.

I want to search one event (ex: [11/28/11 0:59:57:958 EST] 000027ad SystemOut O AggCd , RqUID 2011-11-28T00:59:57-05:0033999785, test# 20412042, TransTypeCd PE, SubTransTypeCd , Term CURRENT, Status 00) at a time rather than all the 5 lines as shown above.

[Ayn]

I don't understand, these look like multiple events, not just one event with multiple lines. Is that correct? If so, please clarify what you would like to achieve and how you aren't achieving it now.