SPLK-1003 · Question #120
Which setting allows the configuration of Splunk to allow events to span over more than one line?
The correct answer is A. SHOULD_LINEMERGE = true. Setting 'SHOULD_LINEMERGE = true' in props.conf instructs Splunk's line-breaking processor to merge multiple consecutive lines into a single event based on additional line-merging rules (such as BREAK_ONLY_BEFORE_DATE or BREAK_ONLY_BEFORE). Setting SHOULD_LINEMERGE = false (D)…
Question
Which setting allows the configuration of Splunk to allow events to span over more than one line?
Options
- ASHOULD_LINEMERGE = true
- BBREAK_ONLY_BEFORE_DATE = true
- CBREAK_ONLY_BEFORE = <REGEX pattern>
- DSHOULD_LINEMERGE = false
How the community answered
(41 responses)- A85% (35)
- B10% (4)
- C2% (1)
- D2% (1)
Explanation
Setting 'SHOULD_LINEMERGE = true' in props.conf instructs Splunk's line-breaking processor to merge multiple consecutive lines into a single event based on additional line-merging rules (such as BREAK_ONLY_BEFORE_DATE or BREAK_ONLY_BEFORE). Setting SHOULD_LINEMERGE = false (D) disables line merging, treating each line as a separate event. BREAK_ONLY_BEFORE_DATE and BREAK_ONLY_BEFORE are supplemental settings that only take effect when SHOULD_LINEMERGE is true.
Topics
Community Discussion
No community discussion yet for this question.