topic Why is Splunk not maintaining line breaks as in the original log? in Getting Data In

Why is Splunk not maintaining line breaks as in the original log?

spsrasru — Mon, 18 Aug 2014 20:56:11 GMT

splunk enterprise 6.1.1

In search view on the Splunk search head web front end, as well as in table view in the email alerts, Splunk is not maintaining line breaks as in the original log.

Re: Why is Splunk not maintaining line breaks as in the original log?

strive — Mon, 18 Aug 2014 21:17:50 GMT

Can you post the original log samples and also explain where Splunk is not maintaining line breaks

Re: Why is Splunk not maintaining line breaks as in the original log?

adamw — Tue, 14 Oct 2014 16:46:41 GMT

Other users are reporting the same thing since the upgrade to 6.1:
http://answers.splunk.com/answers/138053/line-breaks-being-removed-from-raw-data-in-email-alerts-after-upgrade-to-6-1.html

Re: Why is Splunk not maintaining line breaks as in the original log?

yuanliu — Tue, 14 Oct 2014 16:54:18 GMT

@adamw the link points to this question itself. This said, I have seen this before 6, too. Does it have to do with overload? I am under the impression that this tends to happen when volume is extremely high, although I do not have direct measurement.

Re: Why is Splunk not maintaining line breaks as in the original log?

adamw — Tue, 14 Oct 2014 16:58:29 GMT

@yuanliu sorry, copy and paste fail. Updated the link to the other question.

The alert I see it on is one where the output in each _raw cell is around 20 lines. Under 6.0 it showed the _raw field in the table with the proper line breaks, but since our 6.1 upgrade, it ignores newlines in _raw and mashes all of the log data into one text blob.

It still looks properly line break'ed in the search UI.

Re: Why is Splunk not maintaining line breaks as in the original log?

maimonoded — Tue, 27 Jan 2015 12:49:07 GMT

anyone have a solution/workaround for this issue?

Re: Why is Splunk not maintaining line breaks as in the original log?

edoardo_vicendo — Tue, 12 Mar 2019 16:03:28 GMT

Ciao,

Please check my answer reported here:

https://answers.splunk.com/answers/494716/how-to-split-a-multi-line-raw-to-a-multivalue-with.html?childToView=733420#answer-733420

basically you can do in this way:

your base search | rex max_match=0 "^(?<lines>.+)\n+" | eval raw2=mvindex(lines,0,-1) | table raw2

Best Regards,
Edoardo