topic Newline in events in Splunk Dev

Newline in events

arpit_arora — Mon, 23 Apr 2018 18:41:05 GMT

Hello, I have Splunk events (stacktrace) which have '\n' in them. I want these '\n' to appear as new lines (but not new event).

So for example, currently my event might look like

aaaaa \n bbbbb \n ccccc \n ddddd

I want this event to appear as follows.

aaaaa
bbbbb
ccccc
ddddd

I know we can use rex command for this at search time, but I want the events to be indexed with \n character stored as newline.

How can I do this at index time?

Re: Newline in events

niketn — Mon, 23 Apr 2018 20:42:20 GMT

@arpit_arora, try to take your rex to fields.conf for configuring multi-value fields using TOKENIZER: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureSplunktoparsemulti-valuefields

Re: Newline in events

somesoni2 — Mon, 23 Apr 2018 20:56:44 GMT

Assuming when you say your can do the same at search time using rex mode=sed option, you can do the same at index-time using SEDCMD option in the props.conf. See this for more details:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Anonymizedata

Re: Newline in events

woodcock — Mon, 23 Apr 2018 20:59:07 GMT

This is generally done in props.conf on your indexers by setting SHOULD_LINEMERGE = false (yes, I know that might seem wrong) and LINE_BREAKER to a very carefully constructed RegEx that determines where to break them apart, for your sourcetype.