https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaking-on-ADmanagerplus-log/m-p/252299#M48504 <P>I am working on ingesting ADmanagerplus logs. I am having difficulty linebreaking the following log which represents one event. How can I successfully configure this so splunk recognizes this as one event and not one event per line. </P> <PRE><CODE>[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Contact Modification| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Task:Modify Single Group| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Object Name:GoofysStore| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Domain Name:acme.local| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Properties:| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: managedBy = CN=Acme,OU=Users,OU=US,DC=acme,DC=local| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Modification Status:Successfully Updated.| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************| </CODE></PRE> Tue, 24 Jan 2017 21:04:27 GMT wliu_ondeck 2017-01-24T21:04:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaking-on-ADmanagerplus-log/m-p/252299#M48504 <P>I am working on ingesting ADmanagerplus logs. I am having difficulty linebreaking the following log which represents one event. How can I successfully configure this so splunk recognizes this as one event and not one event per line. </P> <PRE><CODE>[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Contact Modification| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Task:Modify Single Group| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Object Name:GoofysStore| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Domain Name:acme.local| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Properties:| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: managedBy = CN=Acme,OU=Users,OU=US,DC=acme,DC=local| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Modification Status:Successfully Updated.| [09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************| </CODE></PRE> Tue, 24 Jan 2017 21:04:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaking-on-ADmanagerplus-log/m-p/252299#M48504 wliu_ondeck 2017-01-24T21:04:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaking-on-ADmanagerplus-log/m-p/252300#M48505 <P>Found solution via regex. <CODE>^.*\[\d*\]: ((?![\*:=]).)*$</CODE></P> Tue, 24 Jan 2017 22:18:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaking-on-ADmanagerplus-log/m-p/252300#M48505 wliu_ondeck 2017-01-24T22:18:59Z