Splunk Search

Why does Splunk log multiple lines as a single event?

neenu-chandran
Observer

I am facing an issue in which Splunk logs multiple lines as a single event- The timestamp seems to be different, 

I've attached logs for the same.

 

 

21:20:14,817 INFO  [exec-68932] Interceptor.setParameters(Interceptor.java:223) - set setParameters to decode access token and id token 
21:20:14,817 INFO  [exec-68932] Interceptor.setParameters(Interceptor.java:253) - cached id 
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:95) - Get Customer id 
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:107) - User obtained
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:113) - Get flag 
21:20:14,820 INFO  [exec-68932] preferences(Controller.java:114) - method=GET:type=Start
21:20:14,820 INFO  [exec-68932] getService(userService.java:269) - turnOn Variable
21:20:14,836 INFO  [exec-68948] Interceptor.preHandle(Interceptor.java:71) - Entered Prehandle - Interceptor 
21:20:14,836 INFO  [exec-68948] Interceptor.getCode(Interceptor.java:183) - Constructed url 
21:20:14,849 INFO  [exec-68932] callPost(RestClientUtil.java:104) - callPost(): Excecution Time=28 ms
21:20:14,850 INFO  [exec-68932] getPropertiesService(userService.java:217) - get uiflag
21:20:14,850 INFO  [exec-68932] getPropertiesService(userService.java:220) - getService(): Excecution Time=29 ms
21:20:14,850 INFO  [exec-68932] getService(userService.java:280) - success from service
21:20:14,850 INFO  [exec-68932] getService(userService.java:427) - Ui flag:O
21:20:14,851 INFO  [exec-68932] getService(userService.java:428) - FlagActivate:true 
21:20:14,851 INFO  [exec-68932] getService(userService.java:512) - true:false
21:20:14,851 INFO  [exec-68932] getService(userService.java:548) - email address:
21:20:14,851 INFO  [exec-68932] preferences(Controller.java:127) - method=GET:elapsed=31ms:type=End
21:20:14,851 INFO  [exec-68932] preferences(Controller.java:135) - Redirect url --- 
21:20:14,915 INFO  [exec-68950] Interceptor.preHandle(Interceptor.java:71) - Entered - Interceptor 
21:20:14,916 INFO  [exec-68943] Interceptor.preHandle(Interceptor.java:71) - Entered - Interceptor 
21:20:14,916 INFO  [exec-68943] Interceptor.getCode(Interceptor.java:183) - Constructed url
21:20:15,123 INFO  [exec-68948] Interceptor.setParameters(Interceptor.java:223) - set setParameters to decode access token and id token 
21:20:15,124 INFO  [exec-68948] Interceptor.setParameters(Interceptor.java:253) - cached id
21:20:15,125 INFO  [exec-68948] preferences(Controller.java:95) - Get Customer id 

 

 

Any help would be appreciated.

 

Thanks,

Neenu

Labels (1)
Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi Neenu.. Please update us the inputs.conf for this file..

is this happening only for a particular UF / log / source... is this a new Splunk deployment or long existing one..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

neenu-chandran
Observer

this was a long exisitng one, and this happens for a specific log file

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...