https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585573#M204026 <P>Can anyone suggest why the logs are coming up like this? I added the monitoring stanza.</P> <P>Could anyone suggest some troubleshooting steps/solution?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jackin_0-1645108093020.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/18019i405126987E7B6275/image-size/medium?v=v2&amp;px=400" role="button" title="jackin_0-1645108093020.png" alt="jackin_0-1645108093020.png" /></span></P> <P>inputs.conf stanza</P> <PRE><SPAN>[monitor:///opt/netmonitor/LOG/*]</SPAN><BR /><SPAN>index = osnix</SPAN><BR /><SPAN>sourcetype = ping_status_log_new</SPAN><BR /><SPAN>crcSalt = &lt;SOURCE&gt;</SPAN>&nbsp;</PRE> <P>&nbsp;</P> Thu, 17 Feb 2022 16:03:40 GMT jackin 2022-02-17T16:03:40Z https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585573#M204026 <P>Can anyone suggest why the logs are coming up like this? I added the monitoring stanza.</P> <P>Could anyone suggest some troubleshooting steps/solution?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jackin_0-1645108093020.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/18019i405126987E7B6275/image-size/medium?v=v2&amp;px=400" role="button" title="jackin_0-1645108093020.png" alt="jackin_0-1645108093020.png" /></span></P> <P>inputs.conf stanza</P> <PRE><SPAN>[monitor:///opt/netmonitor/LOG/*]</SPAN><BR /><SPAN>index = osnix</SPAN><BR /><SPAN>sourcetype = ping_status_log_new</SPAN><BR /><SPAN>crcSalt = &lt;SOURCE&gt;</SPAN>&nbsp;</PRE> <P>&nbsp;</P> Thu, 17 Feb 2022 16:03:40 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585573#M204026 jackin 2022-02-17T16:03:40Z https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585575#M204027 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/239496">@jackin</a>,</P><P>The logs you're indexing contain a line separation.</P><P>You couls filter it following the instructions at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues</A></P><P>in few words:</P><P>in props.conf</P><P>&nbsp;</P><LI-CODE lang="markup">[ping_status_log_new] TRANSFORMS-null= setnull</LI-CODE><P>&nbsp;</P><P>in transform.conf</P><P>&nbsp;</P><LI-CODE lang="markup">[setnull] REGEX = \-{10} DEST_KEY = queue FORMAT = nullQueue</LI-CODE><P>&nbsp;</P><P>Ciao.</P><P>Giuseppe</P> Thu, 17 Feb 2022 14:36:01 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585575#M204027 gcusello 2022-02-17T14:36:01Z https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585577#M204028 <P>That can also be a separator between events and the events themselves can be multilined.</P><P>In such case you'd do something like</P><PRE>LINE_BREAKER = (-{20,}[\r\n])<BR />SHOULD_LINEMERGE = false</PRE> Thu, 17 Feb 2022 14:45:44 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-logs-coming-up-with-hyphens-dashes/m-p/585577#M204028 PickleRick 2022-02-17T14:45:44Z