https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373049#M109735 <P>Hi Somesoni,<BR /> I have the same problem in splitting the events, I tried your above answer but it is not working.</P> <P>Here is my requirement, I want to split the log in to multiple events based on the delimiter "========" . So that i will get 3 events in splunk<BR /> abc<BR /> text file: 123<BR /> name: 235</P> <H1>list: 6363</H1> <P>dfdf<BR /> text file: df<BR /> name: ggg</P> <H1>list: fdgdfg</H1> <P>cds<BR /> text file: 1fd3<BR /> name: ff35</P> <H1>list: 6sd</H1> Fri, 22 Sep 2017 06:31:27 GMT senthamilselvan 2017-09-22T06:31:27Z https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373045#M109731 <P>Hi I have the text file with below sample data I have to break the events using <BR /> "-------------------------" as event break</P> <P>abc</P> <P>text file: 123<BR /> name: 235<BR /> list: 6363</P> <HR /> <P>dfdf</P> <P>text file: df<BR /> name: ggg<BR /> list: fdgdfg</P> <HR /> <P>abc</P> <P>text file: 123<BR /> name: 235<BR /> list: 6363</P> <HR /> <P>cds</P> <P>text file: 1fd3<BR /> name: ff35<BR /> list: 6sd</P> Wed, 28 Jun 2017 13:11:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373045#M109731 kiran331 2017-06-28T13:11:33Z https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373046#M109732 <P>Try this</P> <P>props.conf on indexer/heavy forwarder</P> <PRE><CODE>[yoursourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)(?=\-+) DATETIME_CONFIG=CURRENT </CODE></PRE> Wed, 28 Jun 2017 13:55:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373046#M109732 somesoni2 2017-06-28T13:55:09Z https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373047#M109733 <P>Hi Somesoni, I Have "-------------------------" in the text </P> <H2> after each group details. I have to split the events after </H2> Wed, 28 Jun 2017 20:11:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373047#M109733 kiran331 2017-06-28T20:11:18Z https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373048#M109734 <P>I believe the above configuration should do that. Did you get a chance to test it (or share what failed if you've)?</P> Wed, 28 Jun 2017 21:13:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373048#M109734 somesoni2 2017-06-28T21:13:53Z https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373049#M109735 <P>Hi Somesoni,<BR /> I have the same problem in splitting the events, I tried your above answer but it is not working.</P> <P>Here is my requirement, I want to split the log in to multiple events based on the delimiter "========" . So that i will get 3 events in splunk<BR /> abc<BR /> text file: 123<BR /> name: 235</P> <H1>list: 6363</H1> <P>dfdf<BR /> text file: df<BR /> name: ggg</P> <H1>list: fdgdfg</H1> <P>cds<BR /> text file: 1fd3<BR /> name: ff35</P> <H1>list: 6sd</H1> Fri, 22 Sep 2017 06:31:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-the-events-using-regex/m-p/373049#M109735 senthamilselvan 2017-09-22T06:31:27Z