https://community.splunk.com/t5/Getting-Data-In/html-event-line-break-configuration/m-p/636895#M108932 <LI-CODE lang="markup">&lt;html&gt;&lt;head&gt; &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8"&gt;&lt;meta name="Generator" content="Microsoft Word 15 (filtered medium)"&gt;&lt;style&gt; &lt;!-- @font-face {font-family:"Cambria Math"} @font-face {font-family:Calibri} p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:11.0pt; font-family:"Calibri",sans-serif} span.EmailStyle17 {font-family:"Calibri",sans-serif; color:windowtext} .MsoChpDefault {font-family:"Calibri",sans-serif} @page WordSection1 {margin:1.0in 1.0in 1.0in 1.0in} div.WordSection1 {} --&gt; &lt;/style&gt;&lt;/head&gt;&lt;body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word"&gt;&lt;div class="WordSection1"&gt;&lt;p class="MsoNormal"&gt;&lt;br&gt;Dear [User],&lt;/p&gt;&lt;p class="MsoNormal"&gt;&amp;nbsp;&lt;/p&gt;&lt;p class="MsoNormal"&gt;&lt;br&gt;I am writing to provide you with an update on the recent test email incident that occurred.&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;If you have any questions or concerns, please do not hesitate to contact our team.&lt;br&gt;Thank you for your attention to this matter.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&lt;p class="MsoNormal"&gt;Sincerely,&lt;br&gt;&lt;br&gt;&lt;/p&gt;&lt;p class="MsoNormal"&gt;&amp;nbsp;&lt;/p&gt;&lt;p class="MsoNormal"&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;/body&gt;&lt;/html&gt;&lt;div class=""&gt;&lt;p class=""&gt;Above format I get my body of the email in Splunk body field How do I get this to look like below in Splunk.&lt;br /&gt;What should you in Line breaker configuration sourcetype?&lt;br /&gt;&lt;br /&gt;Dear [User],&lt;/p&gt;&lt;p class=""&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=""&gt;&lt;br /&gt;I am writing to provide you with an update on the recent test email incident that occurred.&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;If you have any questions or concerns, please do not hesitate to contact our team.&lt;br /&gt;Thank you for your attention to this matter.&lt;br /&gt;&lt;br /&gt;&lt;/p&gt;&lt;p class=""&gt;Sincerely,&lt;br /&gt;&lt;br /&gt;&lt;/p&gt;&lt;p class=""&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=""&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;</LI-CODE> Fri, 31 Mar 2023 14:43:47 GMT karu0711 2023-03-31T14:43:47Z https://community.splunk.com/t5/Getting-Data-In/html-event-line-break-configuration/m-p/636895#M108932 <LI-CODE lang="markup">&lt;html&gt;&lt;head&gt; &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8"&gt;&lt;meta name="Generator" content="Microsoft Word 15 (filtered medium)"&gt;&lt;style&gt; &lt;!-- @font-face {font-family:"Cambria Math"} @font-face {font-family:Calibri} p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:11.0pt; font-family:"Calibri",sans-serif} span.EmailStyle17 {font-family:"Calibri",sans-serif; color:windowtext} .MsoChpDefault {font-family:"Calibri",sans-serif} @page WordSection1 {margin:1.0in 1.0in 1.0in 1.0in} div.WordSection1 {} --&gt; &lt;/style&gt;&lt;/head&gt;&lt;body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word"&gt;&lt;div class="WordSection1"&gt;&lt;p class="MsoNormal"&gt;&lt;br&gt;Dear [User],&lt;/p&gt;&lt;p class="MsoNormal"&gt;&amp;nbsp;&lt;/p&gt;&lt;p class="MsoNormal"&gt;&lt;br&gt;I am writing to provide you with an update on the recent test email incident that occurred.&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;If you have any questions or concerns, please do not hesitate to contact our team.&lt;br&gt;Thank you for your attention to this matter.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&lt;p class="MsoNormal"&gt;Sincerely,&lt;br&gt;&lt;br&gt;&lt;/p&gt;&lt;p class="MsoNormal"&gt;&amp;nbsp;&lt;/p&gt;&lt;p class="MsoNormal"&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;/body&gt;&lt;/html&gt;&lt;div class=""&gt;&lt;p class=""&gt;Above format I get my body of the email in Splunk body field How do I get this to look like below in Splunk.&lt;br /&gt;What should you in Line breaker configuration sourcetype?&lt;br /&gt;&lt;br /&gt;Dear [User],&lt;/p&gt;&lt;p class=""&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=""&gt;&lt;br /&gt;I am writing to provide you with an update on the recent test email incident that occurred.&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;If you have any questions or concerns, please do not hesitate to contact our team.&lt;br /&gt;Thank you for your attention to this matter.&lt;br /&gt;&lt;br /&gt;&lt;/p&gt;&lt;p class=""&gt;Sincerely,&lt;br /&gt;&lt;br /&gt;&lt;/p&gt;&lt;p class=""&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=""&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;</LI-CODE> Fri, 31 Mar 2023 14:43:47 GMT https://community.splunk.com/t5/Getting-Data-In/html-event-line-break-configuration/m-p/636895#M108932 karu0711 2023-03-31T14:43:47Z https://community.splunk.com/t5/Getting-Data-In/html-event-line-break-configuration/m-p/636899#M108936 <DIV class="">&nbsp;</DIV><P>&nbsp;</P><LI-CODE lang="markup"></LI-CODE><P>&nbsp;</P><P class="">I want above html email body field to look like below text. how do I configure sourcetype parse the data properly.</P><P class="">&nbsp;<BR />Dear [User],</P><P class="">&amp;nbsp;</P><P class=""><BR />I am writing to provide you with an update on the recent test email incident that occurred.<BR /><BR /><BR /><BR />If you have any questions or concerns, please do not hesitate to contact our team.<BR />Thank you for your attention to this matter.<BR /><BR /></P><P class="">Sincerely,<BR /><BR /></P><P class="">&amp;nbsp;</P><P class="">&amp;nbsp;</P> Fri, 31 Mar 2023 14:57:28 GMT https://community.splunk.com/t5/Getting-Data-In/html-event-line-break-configuration/m-p/636899#M108936 karu0711 2023-03-31T14:57:28Z