We see some events with timestamps clubbed together in one event.
Changing the props.conf did not help to resolve the issue.
Sample:
12/8/15
12:07:53.000 AM
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O File modification detected
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Reading data from file '/opt/Jenkins/was_deploy/jvmDateCalculator.properties'
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Date format is 'yyyy-MM-dd'
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Base date from file is 2015-04-21
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Base date was incremented on 0 days with result: 2015-04-21
You need to set SHOULD_LINEMERGE
to false
.
@athorat, where is the clubbing and what's in your props.conf. One of the following props should help you - depends on your event
# Use the following attributes to specify how multiline events are handled.
SHOULD_LINEMERGE = [true|false]
* When set to true, Splunk combines several lines of data into a single
multiline event, based on the following configuration attributes.
* Defaults to true.
# When SHOULD_LINEMERGE is set to true, use the following attributes to
# define how Splunk builds multiline events.
BREAK_ONLY_BEFORE_DATE = [true|false]
* When set to true, Splunk creates a new event only if it encounters a new
line with a date.
* Note, when using DATETIME_CONFIG = CURRENT or NONE, this setting is not
meaningful, as timestamps are not identified.
* Defaults to true.
BREAK_ONLY_BEFORE = <regular expression>
* When set, Splunk creates a new event only if it encounters a new line that
matches the regular expression.
* Defaults to empty.
MUST_BREAK_AFTER = <regular expression>
* When set and the regular expression matches the current line, Splunk
creates a new event for the next input line.
* Splunk may still break before the current line if another rule matches.
* Defaults to empty.