topic Re: How to create a line break in an event log? in Getting Data In

How to create a line break in an event log?

pgbr7 — Wed, 05 Oct 2016 14:47:04 GMT

Hello guys,

I need to create a line break in an event log, I have the [ \n ] in log.

I try this :

| rex mode=sed field=_raw "s/[\\n]/\n/g"

This log:

6.6.6.6 ASM: "Non-arowser Client","2014-07-15 10:21:12","4.26.140.234","443","BR","/dark-mundo-15/mundo_blue_udp_85116064569258_1","N/A","185.85.69.87","185.85.69.87%0","6.6.6.6","GET","2014-07-15 10:16:03","/dark-mundo-15/mundo_blue_udp_85116064569258_1","HTTPS","","GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatiale; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727;

Is it possible or do I need the set it in the props.conf ?

Re: How to create a line break in an event log?

dmaislin_splunk — Wed, 05 Oct 2016 16:16:50 GMT

Maybe:

| rex mode=sed field=_raw "s/\\r\\n/\n/g"

I didn't try to load your event yet but I figured I would give it a good guess...

Re: How to create a line break in an event log?

pgbr7 — Wed, 05 Oct 2016 17:00:49 GMT

Thanks, but it did not work.

I tried in Splunk Web. I can change letter and number, but if i try line break, it doesn't work.

Re: How to create a line break in an event log?

pgbr7 — Sat, 08 Oct 2016 16:41:54 GMT

Thanks, I used the following and it worked:

| rex mode=sed field=_raw "s/.r.n/ \n/g