Splunk Dev

Why is "must_break_after" not working?

akhil36109
New Member

I have some events and some of them are getting broken while some of them are not.
I tried everything MUST_BREAK_AFTER and LINE_BREAKER.
My event shd break after "batch_size: 15"
I have 457 events:

Single event = "apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15 "

but some events are merged like below and giving only one event for 257 events together.

... 2 lines omitted ...
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15

props.conf I used:

[sourcetype]
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = batch_size:\s+\d+ 

Please help me.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

It looks like there's a line break - why not use SHOULD_LINEMERGE = false instead? I

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...