Splunk Search

Searching for merged events in Splunk

nawazns5038
Builder

Hi,

I have found that there are some events in Splunk that are merged and it is on a random basis and in a huge dataset.

Can I please know if there is a way to find the events that are merged.

All the events are in JSON format.

Thanks

0 Karma
1 Solution

nawazns5038
Builder

index=abcd | regex "}\n{"

The above query worked . It will search for merged events in JSON format.

View solution in original post

0 Karma

nawazns5038
Builder

index=abcd | regex "}\n{"

The above query worked . It will search for merged events in JSON format.

0 Karma

amitm05
Builder

Similar problem of merged events (not json though) will give you a good idea around the solution.
https://answers.splunk.com/answers/590914/need-some-help-with-event-breaks.html

Would be able to help more if you mention your sample events and the rules you have defined for them

0 Karma

nawazns5038
Builder
    {
      "hello": "hello",
      "colors": {
        "red": "red",
        "blue": "blue",
        "green": "green"
      }
    }

    {
      "num_of_books": {
        "one": "1 book",
        "other": "%{count} books"
      }
    }

Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf .

I just want to know how many of these objects were merged instead of indexing into a single event,

how can we write a SPL query to identify the merged events.

0 Karma

Shan
Builder

@nawazns5038,

Take a look into below answer. Provide some sample data and explain what exactly the issue..

[https://answers.splunk.com/answers/124334/finding-the-field-difference-between-previous-event-and-cu...]

Thanks ..

0 Karma

nawazns5038
Builder
    {
      "hello": "hello",
      "colors": {
        "red": "red",
        "blue": "blue",
        "green": "green"
      }
    }

    {
      "num_of_books": {
        "one": "1 book",
        "other": "%{count} books"
      }
    }

Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf .

I just want to know how many of these objects were merged instead of indexing into a single event,

how can we write a SPL query to identify the merged events.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...