Yes, and I have an open bug case being worked. ... View more

I was trying to come up with a way to do the job with a single search. On further study, I believe my suggestion won't solve both parts of your problem. Sorry. ... View more

For your sourcetype, I think first of all you could try : SHOULD_LINEMERGE=false; and you can define : BREAK_ONLY_BEFORE=^\d\d:\d\d:\d\d which présents time OR you could try LINE_BREAKER= Use preview when you add data to make sure the indexation is ok, otherwise you have to clean up the index and reindex. ... View more

The 2nd option really doesn't make sense because the inputscsv source should be the bigger one, provided we dedup the other source. ... View more

The answer to accept is the one bellow. I did not received any point ... View more