Getting Data In

How does Splunk calculate linecount?

mloven_splunk
Splunk Employee
Splunk Employee

I have logs that are linebreaking correctly, and are single line events, but the linecount is showing as "2".

I poked around in the original file and there seems to only be single line endings on each line (per vi :set list)

What does Splunk use to calculate linecount?

mattymo
Splunk Employee
Splunk Employee

Hello from the future!

I ran into this exact thing working with OpenTelemetry's HEC exporter. 

It turns out if the "raw" field contains a "\n" it will increment the linecount to 2. 

This is likely because Splunk's default line breaker behaviour is to drop any new lines as part of the capture group it uses "([\r\n]+)" so the logic assumes new lines would be removed.

so if it somehow sneaks into raw (in my case it skips linebreaking due to hec event endpoint)  even tho you dont see it in the raw even on screen it looks to trigger the linecount to be 2. 

 

 

- MattyMo
0 Karma

jplumsdaine22
Influencer

@mloven now that you work for Splunk did you get an answer? I'm seeing the same behavior

0 Karma

cramasta
Builder

Also seeing the same behavior where one line events are showing up at 2. Also only seeing single line endings when checking out the log on the forwarder host

0 Karma

twistedsixty4
Path Finder

I dont know if this answers your question, but you might find your answer here..
http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Indexmulti-lineevents

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...