https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366744#M66677 <P>You need the <CODE>multikv</CODE> command:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Multikv">http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Multikv</A></P> Sun, 19 Mar 2017 02:38:46 GMT woodcock 2017-03-19T02:38:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366742#M66675 <P>I have a script generating an output, however all my output is being registered as one event. I am trying to break each line into an. I tried using the line breaker with regex for end of line. But that fails.</P> <P>Example of the output.</P> <PRE><CODE>Status Tag DisplayName ------ ---- ----------- Quit jflower James Terminated wpunch William Quit madams Mark Terminated jtota Jeff Quit wbaker Baker Quit sjohson Shawn </CODE></PRE> <P>I am trying to extract the header and </P> Sat, 18 Mar 2017 01:37:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366742#M66675 afamoyib 2017-03-18T01:37:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366743#M66676 <P>What sourcetype did you specify for this input?<BR /> The default LINE_BREAKER setting is <CODE>[\r\n]</CODE> which should break events after EOL.<BR /> Please share your props.conf settings.<BR /> Your posting was cut off. What are you trying to extract with the header?</P> Sat, 18 Mar 2017 18:56:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366743#M66676 richgalloway 2017-03-18T18:56:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366744#M66677 <P>You need the <CODE>multikv</CODE> command:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Multikv">http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Multikv</A></P> Sun, 19 Mar 2017 02:38:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366744#M66677 woodcock 2017-03-19T02:38:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366745#M66678 <P>It was not breaking properly because of how powershell formats it output. I converted the output to csv and then ingested it into splunk. It worked like a charm</P> Tue, 21 Nov 2017 21:41:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-line-break-this-structured-log/m-p/366745#M66678 afamoyib 2017-11-21T21:41:00Z