topic multi line event, break with a empty line in Getting Data In

multi line event, break with a empty line

crazyeva — Mon, 13 Aug 2012 03:02:58 GMT

Hi
I want to import some mussy data to splunk
every event takes multi lines
with an empty line declaring its end
likes below shows two events:
XXX XXX XXXX
XXX XXX XX

XXX XXXX XX
XXXX XX XXXXX
XX XXX
The empty line seems to be the only basis on which could be depended to break up the event
But when i "preview" this data, empty lines are filtered.

Re: multi line event, break with a empty line

ziegfried — Mon, 13 Aug 2012 13:03:52 GMT

These props.conf settings should help:

[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ((?:\r?\n){2,})

Re: multi line event, break with a empty line

crazyeva — Thu, 16 Aug 2012 02:46:21 GMT

exactly solved