Splunk GUI seperating event

[Komal0113]

From splunk user we are receiving logs but when it comes to Splunk search head its splitting into different events 

Expected log :

Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70 # Succeeded # Function:[Configuration Management][MML Command] PQR ME:; # 2023-10-26 09:37:51#

splunk dividing into two separate events

Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70  # Succeeded # Function:[Configuration Management][MML Command]

&

LST ME:; # 2023-10-26 09:37:51#

How can i resolve this cannot combine this two because getting seperate event not one after another 

[PickleRick]

1. Search head is the component which spawns searches against indexers which hold the already indexed data. So I assume you meant that you're sending data in some format but it's getting improperly split into events.

2. Sending raw tcp or udp data stream directly to a Splunk component is not the preferred way to go (for several reasons which I will not dig into at this point).

3. What do these events look like on the wire? I'm not 100% sure but I think they might get split at datagram boundary regardless of other settings.

4. Your "split" set of events contains a second event which is _not_a part of the original event. A typo in preparation of the mockup data?

[inventsekar]

Hi @Komal0113 Some more details needed:

• Can we have your Splunk Search Query pls (remove any hostname, ip address, etc from the search query)
• Are you using HF or not
• mostly the props/transforms causes this issue. can we have your props/transforms(only the portion responsible for this APP/add-on/TA is enough)

[Komal0113]

Hi @inventsekar

1) In splunk search query we are using index name for search 

2) Receiving logs via udp port

3) props conf

LINE_BREAKER = (\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})
SHOULD_LINEMERGE = false