Getting Data In

SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true defaults

dglass0215
Path Finder

Hello,

i am trying to understand the documentation surrounding SHOULD_LINEMERGE. It says the default is SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true. If my understanding is correct this means that if a logfile has multiple lines, the multiple lines will be part of one event that is indexed up until the next date/timestamp is found and then that would be another event.

I have a logfile with the following two lines:

2019-12-30 09:16:41:908: Requestor: IMM_Mobile, IsLocal: False
2019-12-30 09:16:41:908: 637132942019089151: Scanned CID: BARCODE:

However, they get indexed as one event and this is not what I want. A previous suggestion to me was to make SHOULD_LINEMERGE = false, however I do not think I want to do that because there are certain entries in the logfile that do span multiple lines.

Any assistance is greatly appreciated!
David

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your understanding of those two settings is correct. It's important, however, to define what constitutes a date. Add TIME_FORMAT = %Y-%m-%d %H:%M:%S:%3N to the appropriate props.conf file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your understanding of those two settings is correct. It's important, however, to define what constitutes a date. Add TIME_FORMAT = %Y-%m-%d %H:%M:%S:%3N to the appropriate props.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dglass0215
Path Finder

Thanks! So far so good. I have not seen an incorrect merging of lines since I added TIME_FORMAT. Will keep monitoring and will mark this as the answer soon.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...