topic Re: LINE_BREAKER not working with most basic settings in Getting Data In

LINE_BREAKER not working with most basic settings

Cuyose — Tue, 29 Sep 2020 22:47:09 GMT

I have a json blob, lets ignore the fact it is json for now. I simply want to force Splunk to break a single blob on a word.

Where the string {"agent" exists multiple times, these are the the only settings I have set in props for the sourcetype.

SHOULD_LINEMERGE = false
LINE_BREAKER = {"agent

This should break, but it is not. Why is Splunk refusing to break this event? Again, I know this is json, but I want to understand LINE_BREAKER, as I have read about 3 novels on its use, and it repeatedly fails when implemented.

Re: LINE_BREAKER not working with most basic settings

richgalloway — Wed, 16 Jan 2019 18:17:48 GMT

The LINE_BREAKER attribute must contain a capture group. Be warned the contents of the capture group will be discarded so choose it carefully. It's perfectly legitimate to have an empty capture group as in LINE_BREAKER = (){"agent.

Re: LINE_BREAKER not working with most basic settings

woodcock — Tue, 29 Sep 2020 22:48:45 GMT

The LINE_BREAKER will not function unless you give it a capture group (there is probably an error in your error log if you search for it with something like index=_* sourcetype=splunkd LINE_BREAKER capture). Everything in the capture group will be discarded. The capture group may be empty, but it MUST exist. Try this:

SHOULD_LINEMERGE = false
LINE_BREAKER = {"agent()

Re: LINE_BREAKER not working with most basic settings

Cuyose — Wed, 16 Jan 2019 18:47:24 GMT

Thanks, I was making it more complicated in my head.

Re: LINE_BREAKER not working with most basic settings

woodcock — Wed, 16 Jan 2019 19:23:03 GMT

Missed it by >that< much.