Hi,
I have found that there are some events in Splunk that are merged and it is on a random basis and in a huge dataset.
Can I please know if there is a way to find the events that are merged.
All the events are in JSON format.
Thanks
index=abcd | regex "}\n{"
The above query worked . It will search for merged events in JSON format.
index=abcd | regex "}\n{"
The above query worked . It will search for merged events in JSON format.
Similar problem of merged events (not json though) will give you a good idea around the solution.
https://answers.splunk.com/answers/590914/need-some-help-with-event-breaks.html
Would be able to help more if you mention your sample events and the rules you have defined for them
{
"hello": "hello",
"colors": {
"red": "red",
"blue": "blue",
"green": "green"
}
}
{
"num_of_books": {
"one": "1 book",
"other": "%{count} books"
}
}
Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf
.
I just want to know how many of these objects were merged instead of indexing into a single event,
how can we write a SPL query to identify the merged events.
@nawazns5038,
Take a look into below answer. Provide some sample data and explain what exactly the issue..
Thanks ..
{
"hello": "hello",
"colors": {
"red": "red",
"blue": "blue",
"green": "green"
}
}
{
"num_of_books": {
"one": "1 book",
"other": "%{count} books"
}
}
Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf
.
I just want to know how many of these objects were merged instead of indexing into a single event,
how can we write a SPL query to identify the merged events.