For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?
A . True
B . False
C . <regex string>
D . Newline Character

Answer: B

Explanation:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking

Attribute: SHOULD_LINEMERGE = [true|false]

Description: When set to true, the Splunk platform combines several input lines into a single event, with configuration based on the settings described in the next section.

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments