Splunk Enterprise Certified Architect — Question 1

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Answer options

• A. Auto
• B. None
• C. True
• D. False

Correct answer: D

Explanation

The SHOULD_LINEMERGE attribute must be set to False when using the LINE_BREAKER attribute in props.conf, as it indicates that multiple lines should not be merged into a single event. If set to True or Auto, it could lead to unintended merging of lines that should be treated as separate events. Setting it to None is not applicable in this context.