I want to get multiline logs in Splunk for my python service. How can I achieve that?

Question

I have a python service which is integrated with the splunk for checking logs. I am getting getting error message in splunk in split lines like in image . I want to get the error in the same line. How can I achieve that using logging?

Answer 1

By default, every line of input to Splunk is considered a separate event. To change that, edit the props.conf file for the source type and change the LINE_BREAKER setting. Set the value to a regular expression that contains a capture group where one event ends and the next begins. I'd suggest such a regex, but can't do so without seeing more example data.

There are other props.conf settings you can use if LINE_BREAKER doesn't solve the problem. For instance, BREAK_ONLY_BEFORE, BREAK_ONLY_BEFORE_DATE, or MUST_BREAK_AFTER.