Searching for merged events in Splunk

[nawazns5038]

Hi,

I have found that there are some events in Splunk that are merged and it is on a random basis and in a huge dataset.

Can I please know if there is a way to find the events that are merged.

All the events are in JSON format.

Thanks

[nawazns5038 · Accepted solution]

index=abcd | regex "}\n{"

The above query worked . It will search for merged events in JSON format.

[amitm05]

Similar problem of merged events (not json though) will give you a good idea around the solution.
https://answers.splunk.com/answers/590914/need-some-help-with-event-breaks.html

Would be able to help more if you mention your sample events and the rules you have defined for them

[nawazns5038]

    {
      "hello": "hello",
      "colors": {
        "red": "red",
        "blue": "blue",
        "green": "green"
      }
    }

    {
      "num_of_books": {
        "one": "1 book",
        "other": "%{count} books"
      }
    }

Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf .

I just want to know how many of these objects were merged instead of indexing into a single event,

how can we write a SPL query to identify the merged events.

[Shan]

@nawazns5038,

Take a look into below answer. Provide some sample data and explain what exactly the issue..

[https://answers.splunk.com/answers/124334/finding-the-field-difference-between-previous-event-and-cu...]

Thanks ..

[nawazns5038]

    {
      "hello": "hello",
      "colors": {
        "red": "red",
        "blue": "blue",
        "green": "green"
      }
    }

    {
      "num_of_books": {
        "one": "1 book",
        "other": "%{count} books"
      }
    }

Suppose I have the above two JSON objects which are indexed into a single event . Technically they should be in two separate events, only few objects on a random basis were merged. I have corrected the issue by modifying the props.conf .

I just want to know how many of these objects were merged instead of indexing into a single event,

how can we write a SPL query to identify the merged events.