ArcSight TCP Connector CRLF line splitting
I wonder if anyone came across the same low-level issue.
I have a TCP SmartConnector listening on, say, TCP port 5000.
A have a custom tool sending multiline events to the connector.
The multiple lines on the same event are split with HEX 0D (carriage return).
Each multiline event is split from each other with HEX OD0A (carriage return / line feed)
--> So the problem right now is that the SmartConnector considers a new event even it is OD or ODOA, resulting in every line as new event.
Question: Do you happen to know if it is possible to somehow tell the connector to consider ODOA in the TCP Streams as a new event indicator???