topic Why is Splunk not showing empty lines when ingesting files? in Getting Data In

Why is Splunk not showing empty lines when ingesting files?

MedralaG — Thu, 10 May 2018 15:35:22 GMT

This is such a basic question I'm almost embarrassed to ask.

When I try to ingest a file into splunk that has some rows of text with empty lines in between some lines (same as in any .conf file) splunk skips the empty rows. I want to be able to see them as I wan to use those blank lines as event breakers.
Why does that happen?

ex:

[test]
test =1
test2 = x

[test3]
blah 
blah

Re: Why is Splunk not showing empty lines when ingesting files?

adonio — Thu, 10 May 2018 19:29:46 GMT

hello there,

check out this answer:
https://answers.splunk.com/answers/24588/how-can-i-check-that-splunk-indexed-the-entire-contents-of-a-given-file.html

hope it helps

Re: Why is Splunk not showing empty lines when ingesting files?

somesoni2 — Thu, 10 May 2018 20:06:40 GMT

Are you breaking events in a way that each line is a separate event in Splunk? Splunk would not index blank lines, probably the reson you don't see it. If you want a whole stanza a one event, you'd need to setup your event breaking to do so.

Re: Why is Splunk not showing empty lines when ingesting files?

MedralaG — Fri, 11 May 2018 08:14:09 GMT

Yes, I know that the capture group of the event breaker gets removed but this happens before I even specify the event breaker.
So if I take a file and try to upload it to Splunk via the web interface, the preview part that lets you define the line breaker and all other index-time props settings already show the content of the file with no empty lines.

Re: Why is Splunk not showing empty lines when ingesting files?

FrankVl — Fri, 11 May 2018 08:30:19 GMT

Isn't that simply because the default line breaker is ([\r\n]+). An empty line is simply a series of \r and or \n characters, so those will all get gobled up by the linebreaking.