Getting Data In

Why does entering new line causes multiple events?

jkim34
New Member

In the web form application, when new line is inserted (by hitting Enter key) in text area, it logs through Logger Factory, and gets sent over to Splunk Cloud. I've realized that this causes multiple events (per new line) instead of one single event.
It is logged in one single statement, however.

LOGGER.info(form.toString());

Is this default behavior? And is there way to make it single event?

0 Karma

nickhills
Ultra Champion

Can you post a log example (sanitised if need be) which shows what the event should look like?

If my comment helps, please give it a thumbs up!
0 Karma

mayurr98
Super Champion

During the parsing phase, data from the input phase is broken up into individual events.
Splunks parsing phase determines where an event starts and the next one begins.
For multi line events Splunk tries to determine event boundaries by looking at the props.conf settings:
For example the line
- BREAK_ONLY_BEFORE_DATE = true (default)-->looks for a new line with a date at the start.
- MAX_EVENTS = 256 (default)--> Allows a maximum of 256 characters per event. (I suspect this might be your problem)
There are many more that you can use there...
Check https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking for all the details.

0 Karma

jkim34
New Member

Hi mayurr98,

I appreciate for the feedback. I know for sure that it isn't 256 characters per event, as event gets created even with few characters. However, I agree that it may be way props.conf is configured. I'll look to see what is going on. Thanks!

0 Karma

mayurr98
Super Champion

yes sure check and let me know ! I may be wrong

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...