https://community.splunk.com/t5/Getting-Data-In/Add-line-breaks-to-events-using-transforms-conf/m-p/229664#M44690 <P>I need to add an additional line break to events at the heavy forwarder. I'm trying to use transforms.conf:</P> <PRE><CODE>[add_linebreak] REGEX = . FORMAT = $0\r\n DEST_KEY= _raw </CODE></PRE> <P>but it's adding a literal [slash]r and [slash]n to the event. Is it possible to add linebreaks at the heavy forwarder?</P> Tue, 17 Nov 2015 21:16:34 GMT mkemmerer 2015-11-17T21:16:34Z https://community.splunk.com/t5/Getting-Data-In/Add-line-breaks-to-events-using-transforms-conf/m-p/229664#M44690 <P>I need to add an additional line break to events at the heavy forwarder. I'm trying to use transforms.conf:</P> <PRE><CODE>[add_linebreak] REGEX = . FORMAT = $0\r\n DEST_KEY= _raw </CODE></PRE> <P>but it's adding a literal [slash]r and [slash]n to the event. Is it possible to add linebreaks at the heavy forwarder?</P> Tue, 17 Nov 2015 21:16:34 GMT https://community.splunk.com/t5/Getting-Data-In/Add-line-breaks-to-events-using-transforms-conf/m-p/229664#M44690 mkemmerer 2015-11-17T21:16:34Z https://community.splunk.com/t5/Getting-Data-In/Add-line-breaks-to-events-using-transforms-conf/m-p/229665#M44691 <P>I found that using SEDCMD in props.conf at the heavy forwarder was the best way to do this. </P> <PRE><CODE>[XmlWinEventLog:Microsoft-Windows-Sysmon/Operational] SEDCMD-add_linebreak = s/&lt;\/Event&gt;/&lt;\/Event&gt;\n\n/g </CODE></PRE> Sat, 21 Nov 2015 03:44:14 GMT https://community.splunk.com/t5/Getting-Data-In/Add-line-breaks-to-events-using-transforms-conf/m-p/229665#M44691 mkemmerer 2015-11-21T03:44:14Z