<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to split a single file into multiple files based on its content header using regex in linux in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381922#M46476</link>
    <description>&lt;P&gt;Hi to be able to understand more here's what my current file format&lt;/P&gt;

&lt;P&gt;FOOD1 header1 header2 header3 header4 header5 header6&lt;BR /&gt;
FOOD1 data1     data2      data3      data4      data5      data6&lt;BR /&gt;
FOOD1 data1     data2      data3      data4      data5      data6&lt;BR /&gt;
FOOD1 data1     data2      data3      data4      data5      data6&lt;BR /&gt;
FOOD2 header7 header8 header9 header10 header11 header12&lt;BR /&gt;
FOOD2 data7      data8      data9      data10     data11      data12&lt;BR /&gt;
FOOD2 data7      data8      data9      data10     data11      data12&lt;BR /&gt;
FOOD2 data7      data8      data9      data10     data11      data12&lt;/P&gt;

&lt;P&gt;It contains 28 different headers in  a single file... all I want is to separate it based on its contents using regex and linux. I used csplit command in linux but the separation of data divides it per event and saved it to one file so 1 raw event into 1 single file. The output I want is FOOD1 into 1 single file and also as FOOD2. The reason I want this to happen is to ingest the FOOD1 and FOOD2 into TSV format and to lessen its parsing function.&lt;/P&gt;

&lt;P&gt;This 1 single file is just part of 4000+ files that will be ingest to splunk daily.&lt;/P&gt;</description>
    <pubDate>Tue, 09 Jul 2019 08:28:01 GMT</pubDate>
    <dc:creator>ejmin</dc:creator>
    <dc:date>2019-07-09T08:28:01Z</dc:date>
    <item>
      <title>How to split a single file into multiple files based on its content header using regex in linux</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381922#M46476</link>
      <description>&lt;P&gt;Hi to be able to understand more here's what my current file format&lt;/P&gt;

&lt;P&gt;FOOD1 header1 header2 header3 header4 header5 header6&lt;BR /&gt;
FOOD1 data1     data2      data3      data4      data5      data6&lt;BR /&gt;
FOOD1 data1     data2      data3      data4      data5      data6&lt;BR /&gt;
FOOD1 data1     data2      data3      data4      data5      data6&lt;BR /&gt;
FOOD2 header7 header8 header9 header10 header11 header12&lt;BR /&gt;
FOOD2 data7      data8      data9      data10     data11      data12&lt;BR /&gt;
FOOD2 data7      data8      data9      data10     data11      data12&lt;BR /&gt;
FOOD2 data7      data8      data9      data10     data11      data12&lt;/P&gt;

&lt;P&gt;It contains 28 different headers in  a single file... all I want is to separate it based on its contents using regex and linux. I used csplit command in linux but the separation of data divides it per event and saved it to one file so 1 raw event into 1 single file. The output I want is FOOD1 into 1 single file and also as FOOD2. The reason I want this to happen is to ingest the FOOD1 and FOOD2 into TSV format and to lessen its parsing function.&lt;/P&gt;

&lt;P&gt;This 1 single file is just part of 4000+ files that will be ingest to splunk daily.&lt;/P&gt;</description>
      <pubDate>Tue, 09 Jul 2019 08:28:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381922#M46476</guid>
      <dc:creator>ejmin</dc:creator>
      <dc:date>2019-07-09T08:28:01Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a single file into multiple files based on its content header using regex in linux</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381923#M46477</link>
      <description>&lt;P&gt;grep FOOD1 /path/to/your/file &amp;gt; /path/to/newFood1File&lt;BR /&gt;
grep FOOD2 /path/to/your/file &amp;gt; /path/to/newFood2File&lt;/P&gt;

&lt;P&gt;...&lt;/P&gt;</description>
      <pubDate>Tue, 09 Jul 2019 09:44:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381923#M46477</guid>
      <dc:creator>jkat54</dc:creator>
      <dc:date>2019-07-09T09:44:29Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a single file into multiple files based on its content header using regex in linux</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381924#M46478</link>
      <description>&lt;P&gt;Thank you very much for your response. I used complicated script to separate one single file but your answer is much more efficient than my code. Thanks again&lt;/P&gt;</description>
      <pubDate>Wed, 10 Jul 2019 01:26:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381924#M46478</guid>
      <dc:creator>ejmin</dc:creator>
      <dc:date>2019-07-10T01:26:22Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a single file into multiple files based on its content header using regex in linux</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381925#M46479</link>
      <description>&lt;P&gt;It was my pleasure!  Cheers!&lt;/P&gt;</description>
      <pubDate>Wed, 10 Jul 2019 01:30:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-split-a-single-file-into-multiple-files-based-on-its/m-p/381925#M46479</guid>
      <dc:creator>jkat54</dc:creator>
      <dc:date>2019-07-10T01:30:46Z</dc:date>
    </item>
  </channel>
</rss>

