Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- entire file to a single event
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
entire file to a single event
SHOULD_LINEMERGE = true
MAX_EVENTS = 99999
TRUNCATE = 9999999
SHOULD_LINEMERGE = false
LINE_BREAKER = ((FAIL*))
I have tried both of above (trying each one at a time) in indexer props.conf ...and restarted splunk..to have a simple text file , entire file to go to single event but whatever I do splunk automatically splitting the file into 2 events
Is there any way to have the entire file to single event
Thank you in advance
AB
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
surprisingly...If i download the file to my PC and upload with same source type then it is reading entire file as single event....
But if the same log file is coming from forwarder, then file is being split into 2 event...
Anybody? please help
Thank you
AB
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
please check the queue size from the forwarder , try indexing a smaller file and see if that is coming through in one piece
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this file is 90 lines only hardly 4kb in size....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually documentation asked to have SHOULD_LINEMERGE= false for LINE_BREAKER ...
anyways tried your suggestion also ...
No Luck 😞
Thank you
AB
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SHOULD_LINEMERGE= TRUE, try with that
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = (.*?)
I tried the above... still file is split into two events....the same regex (.*?) in regex101.com is selecting the entire file
Thank you
AB
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in the LINE_BREAKER you can use regular expression to match end of file , something like (.*?) . Hope that should not break your file into two parts
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
