In Splunk, I have a Delivery Schedule call which lists the date and gives a true or false to see if its available for delivery. Each call takes up 4 lines and there are 200 lines total for each event (50 calls per event). When using a different sourcetype, this call only has 4 lines per event and will list 50 different events. How can I merge all 50 events/calls into 1 event with a linecount=200? Would I have to modify my Props.conf file?
Example:
EVENT 1
<a:DeliveryRange i:type="a:DeliveryDate">
<a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
<a:Date>2015-05-03T01:00:00-04:00</a:Date>
</a:DeliveryRange>
EVENT 2
<a:DeliveryRange i:type="a:DeliveryDate">
<a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
<a:Date>2015-05-04T01:00:00-04:00</a:Date>
</a:DeliveryRange>
WHAT I WANT (Merge the events together)
<a:DeliveryRange i:type="a:DeliveryDate">
<a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
<a:Date>2015-05-03T01:00:00-04:00</a:Date>
</a:DeliveryRange>
<a:DeliveryRange i:type="a:DeliveryDate">
<a:IsAvailableForDelivery>false</a:IsAvailableForDelivery>
<a:Date>2015-05-04T01:00:00-04:00</a:Date>
</a:DeliveryRange>
Try using this in your props.cong file:
SHOULD_LINEMERGE=true
SHOULD_BREAK_BEFORE=Q@W#E$
Try using this in your props.cong file:
SHOULD_LINEMERGE=true
SHOULD_BREAK_BEFORE=Q@W#E$