Guidance Needed: Appending AuditSecurity_Repository.txt and AuditActivity_Repository.txt Logs

[Purushothaman]

Hi Qlik Experts,

I am currently working with two log files from Qlik Sense:

C:\ProgramData\Qlik\Sense\Log\Repository\Audit\AuditSecurity_Repository.txt
C:\ProgramData\Qlik\Sense\Log\Repository\Audit\AuditActivity_Repository.txt

We are using Splunk to extract logs from Qlik Sense for monitoring and analysis purposes. However, with the current setup, Splunk can only extract logs from a single file at a time, either AuditSecurity_Repository.txt or AuditActivity_Repository.txt.

To overcome this limitation, we considered appending the two files into one. However, upon reviewing the headers of both files, I noticed that they are not identical, as shown below:

Given these differences, directly appending the files may not be advisable as it could create issues with data consistency and parsing in Splunk.

Could anyone please provide guidance on the best approach to handle this scenario? Whether it's a recommended method for merging the files or an alternative solution, your advice would be greatly appreciated.

Thank you in advance.