<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Problems with line breaks in a config file in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33719#M6044</link>
    <description>&lt;P&gt;You might add a &lt;CODE&gt;(?i)&lt;/CODE&gt; to the beginning of the &lt;CODE&gt;LINE_BREAKER&lt;/CODE&gt; regex if in fact it's supposed to be case-insensitive.&lt;/P&gt;</description>
    <pubDate>Thu, 10 Feb 2011 14:42:25 GMT</pubDate>
    <dc:creator>gkanapathy</dc:creator>
    <dc:date>2011-02-10T14:42:25Z</dc:date>
    <item>
      <title>Problems with line breaks in a config file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33716#M6041</link>
      <description>&lt;P&gt;I am trying to configure line breaking for a config file that looks like the following (I'm using 4 spaces to indent some of the lines, but it isn't working in the preview).  Only the first config and last end start at the beginning of a new line.  All of the other lines have multiple spaces or tabs:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;config firewall profile-protocol-options  
    edit "strict"  
        config http  
            set port 80   
            set port 8080   
            unset options  
            unset post-lang  
        end  
        config https  
            set port 443   
            set port 8000   
            set options allow-invalid-server-cert no-content-summary  
            unset post-lang  
            set deep-scan enable  
        end  
end
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I want to break the event at the first "config" and the last "end".  I do not want it to break before/after any config or end line that is preceded by one or more spaces.&lt;/P&gt;

&lt;P&gt;I have tried the following at none of them break properly:&lt;/P&gt;

&lt;P&gt;[fortinet_config]&lt;BR /&gt;
SHOULD_LINEMERGE = true&lt;BR /&gt;
MUST_BREAK_AFTER = [^\s]end&lt;BR /&gt;
BREAK_ONLY_BEFORE = [^\s]config  &lt;/P&gt;

&lt;P&gt;[fortinet_config]&lt;BR /&gt;
SHOULD_LINEMERGE = true&lt;BR /&gt;
MUST_BREAK_AFTER = (?i)^end&lt;BR /&gt;
BREAK_ONLY_BEFORE = (?i)^config  &lt;/P&gt;

&lt;P&gt;[fortinet_config]&lt;BR /&gt;
SHOULD_LINEMERGE = true&lt;BR /&gt;
MUST_NOT_BREAK_BEFORE= (?i)^end&lt;BR /&gt;
MUST_NOT_BREAK_AFTER = (?i)^config  &lt;/P&gt;

&lt;P&gt;[fortinet_config]&lt;BR /&gt;
SHOULD_LINEMERGE = true&lt;BR /&gt;
MUST_NOT_BREAK_BEFORE= (?i)end&lt;BR /&gt;
MUST_NOT_BREAK_AFTER = (?i)config  &lt;/P&gt;

&lt;P&gt;Thanks.&lt;/P&gt;</description>
      <pubDate>Thu, 27 Jan 2011 06:36:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33716#M6041</guid>
      <dc:creator>jambajuice</dc:creator>
      <dc:date>2011-01-27T06:36:05Z</dc:date>
    </item>
    <item>
      <title>Re: Problems with line breaks in a config file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33717#M6042</link>
      <description>&lt;P&gt;I'm feeling stupid tonight, so don't I don't want to get deep into the interaction of MUST_BREAK_AFTER and BREAK_ONLY_BEFORE.  If everything is in one of these, you shouldn't need both.  We can dig in later if it's needed?&lt;/P&gt;

&lt;P&gt;The first ruleset is looking for words like 'config' which have somethig besides backslash or s before them.  I think you want BREAK_ONLY_BEFORE = ^config
Does that work alone?&lt;/P&gt;</description>
      <pubDate>Thu, 27 Jan 2011 14:09:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33717#M6042</guid>
      <dc:creator>jrodman</dc:creator>
      <dc:date>2011-01-27T14:09:23Z</dc:date>
    </item>
    <item>
      <title>Re: Problems with line breaks in a config file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33718#M6043</link>
      <description>&lt;P&gt;Here's the best way:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[fortinet_config]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=config)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;It should get you the same results as the possibly clearer but less performant:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[fortinet_config]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = ^config
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 10 Feb 2011 14:40:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33718#M6043</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2011-02-10T14:40:31Z</dc:date>
    </item>
    <item>
      <title>Re: Problems with line breaks in a config file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33719#M6044</link>
      <description>&lt;P&gt;You might add a &lt;CODE&gt;(?i)&lt;/CODE&gt; to the beginning of the &lt;CODE&gt;LINE_BREAKER&lt;/CODE&gt; regex if in fact it's supposed to be case-insensitive.&lt;/P&gt;</description>
      <pubDate>Thu, 10 Feb 2011 14:42:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Problems-with-line-breaks-in-a-config-file/m-p/33719#M6044</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2011-02-10T14:42:25Z</dc:date>
    </item>
  </channel>
</rss>

