Splunk Search

Merge Multiple Events into a Single Event

skoelpin
SplunkTrust
SplunkTrust

In Splunk, I have a Delivery Schedule call which lists the date and gives a true or false to see if its available for delivery. Each call takes up 4 lines and there are 200 lines total for each event (50 calls per event). When using a different sourcetype, this call only has 4 lines per event and will list 50 different events. How can I merge all 50 events/calls into 1 event with a linecount=200? Would I have to modify my Props.conf file?

Example:

EVENT 1

<a:DeliveryRange i:type="a:DeliveryDate">
        <a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
        <a:Date>2015-05-03T01:00:00-04:00</a:Date>
      </a:DeliveryRange>

EVENT 2

<a:DeliveryRange i:type="a:DeliveryDate">
        <a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
        <a:Date>2015-05-04T01:00:00-04:00</a:Date>
      </a:DeliveryRange>

WHAT I WANT (Merge the events together)

<a:DeliveryRange i:type="a:DeliveryDate">
        <a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
        <a:Date>2015-05-03T01:00:00-04:00</a:Date>
      </a:DeliveryRange>
<a:DeliveryRange i:type="a:DeliveryDate">
        <a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
        <a:Date>2015-05-04T01:00:00-04:00</a:Date>
      </a:DeliveryRange>
Tags (1)
0 Karma
1 Solution

harshal_chakran
Builder

Try using this in your props.cong file:
SHOULD_LINEMERGE=true
SHOULD_BREAK_BEFORE=Q@W#E$

View solution in original post

harshal_chakran
Builder

Try using this in your props.cong file:
SHOULD_LINEMERGE=true
SHOULD_BREAK_BEFORE=Q@W#E$

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...