There are a few occasions when log messages can end up lumped together. Sometimes it's because the log format has changed, sometimes the configuration was made badly, and sometimes things just go wonky.
To help deal with this a little, I've created this command for you lovely people to use called split. Using this command, you specify a regular expression that describes the beginning of a new event. For example, the log format for app foo changed yesterday, so we ended up with a bunch of entries in splunk that were blobbed together.
sourcetype="foo" | split start="^\d+-"
In this case, the pattern says "one or more numbers, followed by a dash, at the beginning of a line". This matches "2010-" at the beginning of the log messages in question.
You can then further filter the events, if you only want some of them:
sourcetype="bar" error | split start="^\d+-" | search error
Caveats...
All of the field values from the previous message are copied along. This includes the date, so the date will be whatever was at the beginning of the chunk. If you need a field in the split log message, then they will need to be reparsed using kv, rex or eval.
Feel free to drop me a note.
Vincent Bumgarner
vincent.bumgarner at gmail.com
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.