If D how the mentioned multi-line event will be combined together? The answer is C. We're talking about multi-line events not single-line events. You can't work only with LINE_BREAKER
from props.conf documentation:
You get a significant boost to processing speed when you use LINE_BREAKER to delimit multi-line events (as opposed to using SHOULD_LINEMERGE to reassemble individual lines into multi-line events).
When using LINE_BREAKER to delimit events, SHOULD_LINEMERGE should be set to false, to ensure no further combination of delimited events occurs.
Seems it's A as talking about multi-line events as mentioned in props.conf doc:
SHOULD_LINEMERGE = <boolean>
* Whether or not to combine several lines of data into a single
multiline event, based on the configuration settings listed in
this subsection.
* When you set this to "true", Splunk software combines several lines of data
into a single multi-line event, based on values you configure
in the following settings.
* When you set this to "false", Splunk software does not combine lines of
data into multiline events.
* Default: true
NOTE: You get a significant boost to processing speed when you use
LINE_BREAKER to delimit multi-line events (as opposed to using
SHOULD_LINEMERGE to reassemble individual lines into multi-line events).
* When using LINE_BREAKER to delimit events, SHOULD_LINEMERGE should be set
to false, to ensure no further combination of delimited events occurs.
False is the answer.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Crash_Override
Highly Voted 3 years, 4 months agogatundu_
Most Recent 9 months, 3 weeks agoCaro27
10 months agobobixaka
1 year, 5 months agoHuli7
1 year, 11 months agoemlch
1 year, 11 months agoRedYeti
1 year, 9 months agoMaryKey
2 years agostwong
2 years, 7 months agohuu_nguyen
3 years, 2 months agomanu78
4 years, 3 months agomarvinortega
4 years, 7 months agomarvinortega
4 years, 7 months ago