All Apps and Add-ons

I'm trying to create an event break for a query I created in Splunk DB connect

pc1234
Explorer

I'm trying to create an event break for an Oracle sql query I created in Splunk DB connect
the oracle query generates multiple rows that I would like to consolidate into a single event.
The delimiter is "||" characters that I appended as the last row in the query.
I configured the source type settings as follows:

BREAK_ONLY_BEFORE = ||
SHOULD_LINEMERGE = true
As part of creating the input, I selected current index time as the timestamp.

However, Splunk is creating separate events for each row in the query instead of merging the results into a single event based on the delimiter.

I've tried generating the "II" row at both the beginning and end of the query.

Any suggestions?

Thanks in Advance.

0 Karma

jkat54
SplunkTrust
SplunkTrust

It’s best practice to use a LINE_BREAKER instead.

Try this:

[yourSourcetype]
...
SHOULD_LINEMERGE = 0
LINE_BREAKER = (\|\|)

You’ll have to re index the data to see the results.

xpac
SplunkTrust
SplunkTrust

I'm pretty sure that | behaves as a character with special meaning in regex (| = OR).
Please try escaping them, as this:
||

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...