Splunk Dev

Why is "must_break_after" not working?

akhil36109
New Member

I have some events and some of them are getting broken while some of them are not.
I tried everything MUST_BREAK_AFTER and LINE_BREAKER.
My event shd break after "batch_size: 15"
I have 457 events:

Single event = "apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15 "

but some events are merged like below and giving only one event for 257 events together.

... 2 lines omitted ...
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15

props.conf I used:

[sourcetype]
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = batch_size:\s+\d+ 

Please help me.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

It looks like there's a line break - why not use SHOULD_LINEMERGE = false instead? I

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...