<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: LINE_BREAKER keep the line breaking regex string in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472152#M81147</link>
    <description>&lt;P&gt;I think I can answer my own question. Seems Line breaker needs 1 capturing group. Anything matched in the group will not be indexed.&lt;BR /&gt;
So I updated the LINE_BREAKER to be:&lt;BR /&gt;
    LINE_BREAKER = (\s)this\s&lt;/P&gt;</description>
    <pubDate>Wed, 30 Sep 2020 04:56:56 GMT</pubDate>
    <dc:creator>season88481</dc:creator>
    <dc:date>2020-09-30T04:56:56Z</dc:date>
    <item>
      <title>LINE_BREAKER keep the line breaking regex string</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472151#M81146</link>
      <description>&lt;P&gt;Hi team,&lt;/P&gt;

&lt;P&gt;I have logs like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;This is Tom This is Amy This is David This is Ben
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I want the line breaking to be like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;This is Tom
This is Amy
This is David
This is Ben
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Here is my LINE_BREAKER config&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;LINE_BREAKER = (this)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And my result is like:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; is Tom
 is Amy
 is David
 is Ben
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So how could I keep the line breaking regex? In my case, the "this"?&lt;/P&gt;

&lt;P&gt;Many thanks.&lt;BR /&gt;
S&lt;/P&gt;</description>
      <pubDate>Tue, 14 Apr 2020 02:26:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472151#M81146</guid>
      <dc:creator>season88481</dc:creator>
      <dc:date>2020-04-14T02:26:07Z</dc:date>
    </item>
    <item>
      <title>Re: LINE_BREAKER keep the line breaking regex string</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472152#M81147</link>
      <description>&lt;P&gt;I think I can answer my own question. Seems Line breaker needs 1 capturing group. Anything matched in the group will not be indexed.&lt;BR /&gt;
So I updated the LINE_BREAKER to be:&lt;BR /&gt;
    LINE_BREAKER = (\s)this\s&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 04:56:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472152#M81147</guid>
      <dc:creator>season88481</dc:creator>
      <dc:date>2020-09-30T04:56:56Z</dc:date>
    </item>
    <item>
      <title>Re: LINE_BREAKER keep the line breaking regex string</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472153#M81148</link>
      <description>&lt;P&gt;LINE_BREAKER is REGEX&lt;BR /&gt;
&lt;CODE&gt;this&lt;/CODE&gt; is not same &lt;CODE&gt;This&lt;/CODE&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;LINE_BREAKER = (?i)(\s)This
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;CODE&gt;Line breaker needs 1 capturing group.&lt;/CODE&gt;&lt;BR /&gt;
Yes, you are.&lt;/P&gt;</description>
      <pubDate>Tue, 14 Apr 2020 02:56:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/LINE-BREAKER-keep-the-line-breaking-regex-string/m-p/472153#M81148</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-04-14T02:56:03Z</dc:date>
    </item>
  </channel>
</rss>

