All Apps and Add-ons

I'm trying to create an event break for a query I created in Splunk DB connect

pc1234
Explorer

I'm trying to create an event break for an Oracle sql query I created in Splunk DB connect
the oracle query generates multiple rows that I would like to consolidate into a single event.
The delimiter is "||" characters that I appended as the last row in the query.
I configured the source type settings as follows:

BREAK_ONLY_BEFORE = ||
SHOULD_LINEMERGE = true
As part of creating the input, I selected current index time as the timestamp.

However, Splunk is creating separate events for each row in the query instead of merging the results into a single event based on the delimiter.

I've tried generating the "II" row at both the beginning and end of the query.

Any suggestions?

Thanks in Advance.

0 Karma

jkat54
SplunkTrust
SplunkTrust

It’s best practice to use a LINE_BREAKER instead.

Try this:

[yourSourcetype]
...
SHOULD_LINEMERGE = 0
LINE_BREAKER = (\|\|)

You’ll have to re index the data to see the results.

xpac
SplunkTrust
SplunkTrust

I'm pretty sure that | behaves as a character with special meaning in regex (| = OR).
Please try escaping them, as this:
||

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...