Splunk Search

Splunk GUI seperating event

Komal0113
Loves-to-Learn

From splunk user we are receiving logs but when it comes to Splunk search head its splitting into different events 

Expected log :

Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70 # Succeeded # Function:[Configuration Management][MML Command] PQR ME:; # 2023-10-26 09:37:51#

splunk dividing into two separate events

Oct 26 09:37:51 +02:00 10.191.248.38 -: Operation%%31051 # Minor # qaz# XYZ # 10.135.114.70  # Succeeded # Function:[Configuration Management][MML Command]

&

LST ME:; # 2023-10-26 09:37:51#

How can i resolve this cannot combine this two because getting seperate event not one after another 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Search head is the component which spawns searches against indexers which hold the already indexed data. So I assume you meant that you're sending data in some format but it's getting improperly split into events.

2. Sending raw tcp or udp data stream directly to a Splunk component is not the preferred way to go (for several reasons which I will not dig into at this point).

3. What do these events look like on the wire? I'm not 100% sure but I think they might get split at datagram boundary regardless of other settings.

4. Your "split" set of events contains a second event which is _not_a part of the original event. A typo in preparation of the mockup data?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Komal0113 Some more details needed:

  • Can we have your Splunk Search Query pls (remove any hostname, ip address, etc from the search query)
  • Are you using HF or not
  • mostly the props/transforms causes this issue. can we have your props/transforms(only the portion responsible for this APP/add-on/TA is enough)
0 Karma

Komal0113
Loves-to-Learn

Hi @inventsekar

1) In splunk search query we are using index name for search 

2) Receiving logs via udp port

3) props conf

LINE_BREAKER = (\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})
SHOULD_LINEMERGE = false


 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...