<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Configure multiple LINE_BREAKER strings? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29679#M5118</link>
    <description>&lt;P&gt;Give this a try:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;LINE_BREAKER = ([\r\n]+BK2)|([\r\n]+)(?=BK1)&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Hope this helps.&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;&amp;gt; please upvote and accept answer if you find it useful - thanks!&lt;/CODE&gt;&lt;/P&gt;</description>
    <pubDate>Tue, 06 Dec 2011 20:47:50 GMT</pubDate>
    <dc:creator>_d_</dc:creator>
    <dc:date>2011-12-06T20:47:50Z</dc:date>
    <item>
      <title>Configure multiple LINE_BREAKER strings?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29678#M5117</link>
      <description>&lt;P&gt;I have line breaks signified by 2 different strings.&lt;BR /&gt;&lt;BR /&gt;
This works (keeping BK1 text as part of next event):  &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;LINE_BREAKER = ([\r\n]+)(BK1)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This works (discarding BK2 text as part of breaker):  &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;LINE_BREAKER = ([\r\n]+BK2)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;But this does not work:  &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;LINE_BREAKER = (?:([\r\n]+)(BK1))|(?:([\r\n]+BK2))
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I assume this doesn't work because the 3 captures are taken as $1, $2 and $3 (and $3 is undefined as far as LINE_BREAKER REGEX goes) instead of as $1, $2v1, $2v2.&lt;/P&gt;</description>
      <pubDate>Tue, 06 Dec 2011 20:17:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29678#M5117</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2011-12-06T20:17:53Z</dc:date>
    </item>
    <item>
      <title>Re: Configure multiple LINE_BREAKER strings?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29679#M5118</link>
      <description>&lt;P&gt;Give this a try:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;LINE_BREAKER = ([\r\n]+BK2)|([\r\n]+)(?=BK1)&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Hope this helps.&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;&amp;gt; please upvote and accept answer if you find it useful - thanks!&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 06 Dec 2011 20:47:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29679#M5118</guid>
      <dc:creator>_d_</dc:creator>
      <dc:date>2011-12-06T20:47:50Z</dc:date>
    </item>
    <item>
      <title>Re: Configure multiple LINE_BREAKER strings?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29680#M5119</link>
      <description>&lt;P&gt;You can try:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;LINE_BRAKER=([\r\n]+(?=BK1)|[\r\n]+BK2)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;However this is subject to lookahead limitations: if I remember correctly this means you can not use +,? and * in BK1 (not sure about {n})&lt;/P&gt;</description>
      <pubDate>Thu, 15 Dec 2011 08:27:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29680#M5119</guid>
      <dc:creator>fairoldi</dc:creator>
      <dc:date>2011-12-15T08:27:20Z</dc:date>
    </item>
    <item>
      <title>Re: Configure multiple LINE_BREAKER strings?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29681#M5120</link>
      <description>&lt;P&gt;I find that dealing with LINE_BREAKER settings tends to get messy when often it's simpler and equally effective to achieve the same thing by configuring proper line merging settings instead. Have you investigated that option?&lt;/P&gt;</description>
      <pubDate>Thu, 15 Dec 2011 09:05:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29681#M5120</guid>
      <dc:creator>Ayn</dc:creator>
      <dc:date>2011-12-15T09:05:11Z</dc:date>
    </item>
    <item>
      <title>Re: Configure multiple LINE_BREAKER strings?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29682#M5121</link>
      <description>&lt;P&gt;No worky; this completely ate the records starting with BK1 (for the same $1/$2/$3 reason/problem).&lt;/P&gt;</description>
      <pubDate>Sat, 06 Jun 2015 05:18:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29682#M5121</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-06-06T05:18:35Z</dc:date>
    </item>
    <item>
      <title>Re: Configure multiple LINE_BREAKER strings?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29683#M5122</link>
      <description>&lt;P&gt;Using &lt;CODE&gt;LINE_BREAKER&lt;/CODE&gt; if it is a valid option, is always the most efficient impact on the Indexer, so I always start there.&lt;/P&gt;</description>
      <pubDate>Wed, 02 May 2018 22:00:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Configure-multiple-LINE-BREAKER-strings/m-p/29683#M5122</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2018-05-02T22:00:15Z</dc:date>
    </item>
  </channel>
</rss>

