Splunk Core Certified Advanced Power User — Question 111

Which setting allows the configuration of Splunk to allow events to span over more than one line?

Answer options

• A. SHOULD_LINEMERGE = true
• B. BREAK_ONLY_BEFORE_DATE = true
• C. BREAK_ONLY_BEFORE =
• D. SHOULD_LINEMERGE = false

Correct answer: A

Explanation

The correct answer, A, allows Splunk to treat multiple lines as a single event, which is essential for correctly parsing multiline logs. Option B, BREAK_ONLY_BEFORE_DATE, is used for breaking events before a date, while options C and D do not support multiline events as they either lack a value or explicitly disable line merging.