https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaks-for-status-code/m-p/405605#M71978 <P>I am creating a sourcetype but my lines are not breaking properly here is my stanza :</P> <PRE><CODE>{"TimeStampString":"6/5/2019 7:47:15 PM","Message":{"StatusCode":"200","DateTime":"6/5/2019 7:47:15 PM","RequestId":"fda7b031-46a3-4b5c-8edf-fa728564d6c9","TransactionType":"api-estfmer-trace-response"},"Priority":0,"Severity":"Information","EventId":0,"Title":"","MachineName":"SWET2WC9A005","AppDomainName":"/LM/W3SVC/9/ROOT/ESTFMER-2-132042366915126615","ProcessId":"72076","ProcessName":"c:\\windows\\system32\\inetsrv\\w3wp.exe","ManagedThreadName":"","ActivityId":"00000000-0000-0000-0000-000000000000","Win32ThreadId":"86496","RelatedActivityId":"","ErrorMessages":"","CategoriesStrings":["Business"]} </CODE></PRE> <P>I want to break the lines from status code and so on, <BR /> below is my config :</P> <PRE><CODE>[ ] BREAK_ONLY_BEFORE=^{ CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=43 SHOULD_LINEMERGE=true disabled=false TIME_FORMAT=%m/%d/%Y %H:%M:%S %p TIME_PREFIX=^{"TimeStampString":" </CODE></PRE> <P>Please let me know what change I need to make ?</P> Wed, 05 Jun 2019 21:12:14 GMT ram254481493 2019-06-05T21:12:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaks-for-status-code/m-p/405605#M71978 <P>I am creating a sourcetype but my lines are not breaking properly here is my stanza :</P> <PRE><CODE>{"TimeStampString":"6/5/2019 7:47:15 PM","Message":{"StatusCode":"200","DateTime":"6/5/2019 7:47:15 PM","RequestId":"fda7b031-46a3-4b5c-8edf-fa728564d6c9","TransactionType":"api-estfmer-trace-response"},"Priority":0,"Severity":"Information","EventId":0,"Title":"","MachineName":"SWET2WC9A005","AppDomainName":"/LM/W3SVC/9/ROOT/ESTFMER-2-132042366915126615","ProcessId":"72076","ProcessName":"c:\\windows\\system32\\inetsrv\\w3wp.exe","ManagedThreadName":"","ActivityId":"00000000-0000-0000-0000-000000000000","Win32ThreadId":"86496","RelatedActivityId":"","ErrorMessages":"","CategoriesStrings":["Business"]} </CODE></PRE> <P>I want to break the lines from status code and so on, <BR /> below is my config :</P> <PRE><CODE>[ ] BREAK_ONLY_BEFORE=^{ CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=43 SHOULD_LINEMERGE=true disabled=false TIME_FORMAT=%m/%d/%Y %H:%M:%S %p TIME_PREFIX=^{"TimeStampString":" </CODE></PRE> <P>Please let me know what change I need to make ?</P> Wed, 05 Jun 2019 21:12:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-line-breaks-for-status-code/m-p/405605#M71978 ram254481493 2019-06-05T21:12:14Z