From splunk user we are receiving logs but when it comes to Splunk search head its splitting into different events
Expected log :
Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70 # Succeeded # Function:[Configuration Management][MML Command] PQR ME:; # 2023-10-26 09:37:51#
splunk dividing into two separate events
Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70 # Succeeded # Function:[Configuration Management][MML Command]
&
LST ME:; # 2023-10-26 09:37:51#
How can i resolve this cannot combine this two because getting seperate event not one after another
1. Search head is the component which spawns searches against indexers which hold the already indexed data. So I assume you meant that you're sending data in some format but it's getting improperly split into events.
2. Sending raw tcp or udp data stream directly to a Splunk component is not the preferred way to go (for several reasons which I will not dig into at this point).
3. What do these events look like on the wire? I'm not 100% sure but I think they might get split at datagram boundary regardless of other settings.
4. Your "split" set of events contains a second event which is _not_a part of the original event. A typo in preparation of the mockup data?
Hi @Komal0113 Some more details needed:
Hi @inventsekar
1) In splunk search query we are using index name for search
2) Receiving logs via udp port
3) props conf
LINE_BREAKER = (\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})
SHOULD_LINEMERGE = false