https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27398#M4612 <P>It worked! Thanks a million <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 08 May 2013 11:32:41 GMT Abha 2013-05-08T11:32:41Z https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27396#M4610 <P>Hi<BR /> I am just exploring how can event break settings be used.Need some help with it.</P> <P>My input data is simply a text document, containing just a paragraph.<BR /> I want Splunk to take every word as one event.<BR /> What LINE_BREAKER do I specify in props.conf??<BR /> Can it be done in any other way?</P> Wed, 08 May 2013 11:03:59 GMT https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27396#M4610 Abha 2013-05-08T11:03:59Z https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27397#M4611 <P>To get each word split into its own event you could do this:</P> <PRE><CODE>LINE_BREAKER=(\W+) SHOULD_LINEMERGE=0 </CODE></PRE> <P>That will break events at every group of non-word characters and consume them so they will not appear in your event.</P> Wed, 08 May 2013 11:27:07 GMT https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27397#M4611 martin_mueller 2013-05-08T11:27:07Z https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27398#M4612 <P>It worked! Thanks a million <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 08 May 2013 11:32:41 GMT https://community.splunk.com/t5/Getting-Data-In/understanding-EVENT-BREAK-settings/m-p/27398#M4612 Abha 2013-05-08T11:32:41Z