https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379993#M95235 <P>Hi @knalla,</P> <P>Your config works for me, but try this :</P> <PRE><CODE>[yoursourcetype] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 LINE_BREAKER=(\r|\n)TBD </CODE></PRE> <P>You can test it out in the gui using add data. </P> <P>Cheers,<BR /> David</P> Tue, 21 May 2019 06:17:39 GMT DavidHourani 2019-05-21T06:17:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379992#M95234 <P>Hi, </P> <P>How to use line breaking to break events before TBD, new event starts with TBD.</P> <P>sample data:</P> <PRE><CODE>ABC*11*231~ CFFGBPR*DD*1212*Ddf*12333~ TBD*1*3234454*12223355~ DFR*ESDFR*5ewewesd112~ dsdd*DD*dd*Ddf*12333~ FTRRD*DFF*455*434*4321~ TBD*1*wewe*2344~ DFR*ESDFR*5ewewesd112~ dsdd*DD*dd*Ddf*12333~ FTRRD*DFF*455*434*4321~ DFR*ESDFR*5ewewesd112~ dsdd*DD*dd*Ddf*12333~ FTRRD*DFF*455*434*4321~ </CODE></PRE> <P>required output:<BR /> event 1</P> <PRE><CODE>TBD*1*3234454*12223355~ DFR*ESDFR*5ewewesd112~ dsdd*DD*dd*Ddf*12333~ FTRRD*DFF*455*434*4321~ </CODE></PRE> <P>event 2</P> <PRE><CODE>TBD*1*wewe*2344~ DFR*ESDFR*5ewewesd112~ dsdd*DD*dd*Ddf*12333~ FTRRD*DFF*455*434*4321~ DFR*ESDFR*5ewewesd112~ dsdd*DD*dd*Ddf*12333~ FTRRD*DFF*455*434*4321~ </CODE></PRE> <P>I tried below stanza, it dint work. Any suggestions?</P> <PRE><CODE>[ ] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE=TBD CHARSET=UTF-8 disabled=false </CODE></PRE> Tue, 21 May 2019 04:37:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379992#M95234 knalla 2019-05-21T04:37:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379993#M95235 <P>Hi @knalla,</P> <P>Your config works for me, but try this :</P> <PRE><CODE>[yoursourcetype] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 LINE_BREAKER=(\r|\n)TBD </CODE></PRE> <P>You can test it out in the gui using add data. </P> <P>Cheers,<BR /> David</P> Tue, 21 May 2019 06:17:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379993#M95235 DavidHourani 2019-05-21T06:17:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379994#M95236 <P>Its working, but its not breaking events if the event start with TBD.</P> Mon, 10 Jun 2019 18:21:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-line-breaking-for-sample-data/m-p/379994#M95236 knalla 2019-06-10T18:21:54Z