topic Re: Event breaking from a single field in Splunk Search

Is it possible to event break from a single field?

rpraveena03 — Tue, 02 May 2023 13:35:26 GMT

I do have a multivalue field with the letters cls and tenant at the end of it. Is it possible to break the data into different rows.

Re: Event breaking from a single field

richgalloway — Tue, 02 May 2023 12:48:39 GMT

Try putting this in one of your props.conf files

[mysourcetype] LINE_BREAKER = ()\{"_cls

Re: Event breaking from a single field

rpraveena03 — Tue, 02 May 2023 12:50:47 GMT

This log is already ingested into Splunk using custom command by the application team. Now I can't go back with props configuration.

Is there any way to achieve through query from UI

Re: Event breaking from a single field

richgalloway — Tue, 02 May 2023 13:48:56 GMT

Unfortunately, poorly-onboarded data stays that way forever. That's why it's important to test the onboarding process before accepting new data. I hope you've had a chat with the application team about that.

There is the split SPL function that can be used in conjunction with mvexpand to break a field into multiple events. That function separates the field based on a single character rather than a string so it won't work in this case.