Splunk Dev

Why is "must_break_after" not working?

akhil36109
New Member

I have some events and some of them are getting broken while some of them are not.
I tried everything MUST_BREAK_AFTER and LINE_BREAKER.
My event shd break after "batch_size: 15"
I have 457 events:

Single event = "apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15 "

but some events are merged like below and giving only one event for 257 events together.

... 2 lines omitted ...
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15
apple Type:apple  size: report  _time: 2017-03-23 01:30:00 batch_delay: 15 
batch_size: 15

props.conf I used:

[sourcetype]
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = batch_size:\s+\d+ 

Please help me.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

It looks like there's a line break - why not use SHOULD_LINEMERGE = false instead? I

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...