topic Re: Why is the regex creating empty events from incoming data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396432#M115116 <P>Hi @derekho55 ,</P> <P>Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you. </P> <P>Thanks for posting!</P> Mon, 17 Jun 2019 21:56:46 GMT evania 2019-06-17T21:56:46Z Why is the regex creating empty events from incoming data? https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396430#M115114 <P>I have a log text file that captures logs in this format:</P> <PRE><CODE>---------------------------------------- Timestamp: 5/9/2019 1:16:02 AM Message: Blah Blah ---------------------------------------- ---------------------------------------- Timestamp: 5/9/2019 1:20:05 AM Message: Bla Bla ---------------------------------------- </CODE></PRE> <P>I'm struggling with creating a regex expression that will not treat it as a new (empty) event.</P> <PRE><CODE>---------------------------------------- ---------------------------------------- </CODE></PRE> <P>Please help. Thanks!</P> Fri, 31 May 2019 20:19:50 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396430#M115114 derekho55 2019-05-31T20:19:50Z Re: Why is the regex creating empty events from incoming data? https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396431#M115115 <P>This method will break the event and remove the top and bottom dashed lines from the event. </P> <P>LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)</P> Fri, 31 May 2019 21:55:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396431#M115115 aromanauskas 2019-05-31T21:55:46Z Re: Why is the regex creating empty events from incoming data? https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396432#M115116 <P>Hi @derekho55 ,</P> <P>Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you. </P> <P>Thanks for posting!</P> Mon, 17 Jun 2019 21:56:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-regex-creating-empty-events-from-incoming-data/m-p/396432#M115116 evania 2019-06-17T21:56:46Z