I have a multi-threaded application in Glassfish. A single event generates multiple lines of logging but multiple events can happen simultaneously causing logging to alternate between one event and another. Each event though will be on a distinct thread ID in the logs.
Is it possible to search for a string and have all the lines withing the min before and after that are on the same thread ID merged to be the one event?
Not sure to understand but maybe transaction can help.
index=glassfish | transaction id_thread keepevicted=true
Transaction consume a lot of resources so reduce the time range.
Every events with the same id_thread will be concat to one.
Can I assume that this is not possible in Splunk?