Why does Splunk log multiple lines as a single event?

[neenu-chandran]

I am facing an issue in which Splunk logs multiple lines as a single event- The timestamp seems to be different, 

I've attached logs for the same.

21:20:14,817 INFO  [exec-68932] Interceptor.setParameters(Interceptor.java:223) - set setParameters to decode access token and id token 
21:20:14,817 INFO  [exec-68932] Interceptor.setParameters(Interceptor.java:253) - cached id 
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:95) - Get Customer id 
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:107) - User obtained
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:113) - Get flag 
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:114) - method=GET:type=Start
21:20:14,820 INFO  [exec-68932] getService(userService.java:269) - turnOn Variable
21:20:14,836 INFO  [exec-68948] Interceptor.preHandle(Interceptor.java:71) - Entered Prehandle - Interceptor 
21:20:14,836 INFO  [exec-68948] Interceptor.getCode(Interceptor.java:183) - Constructed url 
21:20:14,849 INFO  [exec-68932] callPost(RestClientUtil.java:104) - callPost(): Excecution Time=28 ms
21:20:14,850 INFO  [exec-68932] getPropertiesService(userService.java:217) - get uiflag
21:20:14,850 INFO  [exec-68932] getPropertiesService(userService.java:220) - getService(): Excecution Time=29 ms
21:20:14,850 INFO  [exec-68932] getService(userService.java:280) - success from service
21:20:14,850 INFO  [exec-68932] getService(userService.java:427) - Ui flag:O
21:20:14,851 INFO  [exec-68932] getService(userService.java:428) - FlagActivate:true 
21:20:14,851 INFO  [exec-68932] getService(userService.java:512) - true:false
21:20:14,851 INFO  [exec-68932] getService(userService.java:548) - email address:
21:20:14,851 INFO  [exec-68932] preferences(Controller.java:127) - method=GET:elapsed=31ms:type=End
21:20:14,851 INFO  [exec-68932] preferences(Controller.java:135) - Redirect url --- 
21:20:14,915 INFO  [exec-68950] Interceptor.preHandle(Interceptor.java:71) - Entered - Interceptor 
21:20:14,916 INFO  [exec-68943] Interceptor.preHandle(Interceptor.java:71) - Entered - Interceptor 
21:20:14,916 INFO  [exec-68943] Interceptor.getCode(Interceptor.java:183) - Constructed url
21:20:15,123 INFO  [exec-68948] Interceptor.setParameters(Interceptor.java:223) - set setParameters to decode access token and id token 
21:20:15,124 INFO  [exec-68948] Interceptor.setParameters(Interceptor.java:253) - cached id
21:20:15,125 INFO  [exec-68948] preferences(Controller.java:95) - Get Customer id 

Any help would be appreciated.

Thanks,

Neenu

[inventsekar]

Hi Neenu.. Please update us the inputs.conf for this file..

is this happening only for a particular UF / log / source... is this a new Splunk deployment or long existing one..

[neenu-chandran]

this was a long exisitng one, and this happens for a specific log file