<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: line_breaker help in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247275#M47699</link>
    <description>&lt;P&gt;There could be something in your REST call that can be changed to improve your results, but it's impossible to know for sure without seeing the command.&lt;/P&gt;</description>
    <pubDate>Tue, 26 Jan 2016 12:37:15 GMT</pubDate>
    <dc:creator>richgalloway</dc:creator>
    <dc:date>2016-01-26T12:37:15Z</dc:date>
    <item>
      <title>line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247270#M47694</link>
      <description>&lt;P&gt;I'm struggling getting my data to break to events. A REST call gives me a csv in a long straight line, without any character to break. Any help how to fix this?&lt;/P&gt;

&lt;P&gt;This is what it looks like now:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;svc;Time_Stamp;Omgeving;name;Locatie;capacity;free_capacity;virtual_capacity;real_capacity;overalloc;type;Storage_ClassIVB201;2016/01/2518:00:13CET;OTA;B_IVB201_HUB196_1;Best;62603443306496;32838246203392;34303903793152;29762410301440;54;thin;BronsIVB800;2016/01/2518:00:15CET;PRD;B_IVB800_HUB193_1;Best;62602906435584;2785286291456;59817088641536;59817088641536;95;THICK;Brons
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This is what would make me happy:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;svc;Time_Stamp;Omgeving;name;Locatie;capacity;free_capacity;virtual_capacity;real_capacity;overalloc;type;Storage_Class
IVB201;2016/01/25 18:00:13 CET;OTA;B_IVB201_HUB196_1;Best;62603443306496;32838246203392;34303903793152;29762410301440;54;thin;Brons
IVB800;2016/01/25 18:00:15 CET;PRD;B_IVB800_HUB193_1;Best;62602906435584;2785286291456;59817088641536;59817088641536;95;THICK;Brons
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Bonuspoints for the right way to get rid of the header record. &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 25 Jan 2016 21:09:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247270#M47694</guid>
      <dc:creator>renems</dc:creator>
      <dc:date>2016-01-25T21:09:42Z</dc:date>
    </item>
    <item>
      <title>Re: line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247271#M47695</link>
      <description>&lt;P&gt;What REST call is giving you those results?&lt;/P&gt;</description>
      <pubDate>Mon, 25 Jan 2016 21:18:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247271#M47695</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2016-01-25T21:18:14Z</dc:date>
    </item>
    <item>
      <title>Re: line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247272#M47696</link>
      <description>&lt;P&gt;Give this a try (assuming your value of svc field is 6 character long always)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[ &amp;lt;SOURCETYPE NAME&amp;gt; ]
SHOULD_LINEMERGE=false
disabled=false
LINE_BREAKER=([\r\n]*)(?=\w{6};\d+\/\d+)
TIME_FORMAT=%Y/%m/%d%H:%M:%S%Z
TIME_PREFIX=^\w{6};
SEDCMD-removeheader=s/^(svc;.*)//
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 25 Jan 2016 21:28:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247272#M47696</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2016-01-25T21:28:43Z</dc:date>
    </item>
    <item>
      <title>Re: line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247273#M47697</link>
      <description>&lt;P&gt;Thanks for the help. However, it's not the result I was hoping for. In fact, it doesn't seem to work.&lt;BR /&gt;
Could it be because between the last word of the sentence, and the first one of the new one, there's no character in between? Any other suggestions?&lt;/P&gt;</description>
      <pubDate>Mon, 25 Jan 2016 22:26:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247273#M47697</guid>
      <dc:creator>renems</dc:creator>
      <dc:date>2016-01-25T22:26:18Z</dc:date>
    </item>
    <item>
      <title>Re: line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247274#M47698</link>
      <description>&lt;P&gt;Yeah I know, it's not a very good one. &lt;/P&gt;</description>
      <pubDate>Mon, 25 Jan 2016 22:27:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247274#M47698</guid>
      <dc:creator>renems</dc:creator>
      <dc:date>2016-01-25T22:27:01Z</dc:date>
    </item>
    <item>
      <title>Re: line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247275#M47699</link>
      <description>&lt;P&gt;There could be something in your REST call that can be changed to improve your results, but it's impossible to know for sure without seeing the command.&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2016 12:37:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247275#M47699</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2016-01-26T12:37:15Z</dc:date>
    </item>
    <item>
      <title>Re: line_breaker help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247276#M47700</link>
      <description>&lt;P&gt;Hi there Renems,&lt;/P&gt;

&lt;P&gt;Try with this,&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
SEDCMD=s/svc;.*?Storage_Class//g
LINE_BREAKER=([\r\n]*)(?:[A-Z]{1,}\d{1,})(?=;\d{4}\/\d{2}\/\d{4})
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 26 Jan 2016 13:56:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/line-breaker-help/m-p/247276#M47700</guid>
      <dc:creator>alemarzu</dc:creator>
      <dc:date>2016-01-26T13:56:48Z</dc:date>
    </item>
  </channel>
</rss>

