topic Re: Data Onboarding line break at empty lines in Splunk Search

Data Onboarding line break at empty lines

inventsekar — Thu, 18 May 2023 00:57:05 GMT

Hi..

Spent some one or two hrs, but no luck, hence posting here.. the sample logs:

1.1.1. test log a
1.1.1. test log abc

1.1.2. test log b
1.1.2. test log bcd

one thing - no need to worry about timestamps.

one log will have around 10 events.
the lines with the starting 1.1.1. should be one event, 1.1.2. should be next event and so on..

or simply, the empty lines should break the events.

please suggest, thanks.

Re: Data Onboarding line break at empty lines

yeahnah — Thu, 18 May 2023 02:21:24 GMT

Hi @inventsekar

Give this ago...

SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]\s[\r\n]+)

Not exactly sure why the \s makes a difference - regex101 says \s matches any whitespace character (equivalent to [\r\n\t\f\v ]) - but it tested OK when I used it

Hope that helps

Re: Data Onboarding line break at empty lines

inventsekar — Thu, 18 May 2023 02:39:10 GMT

wow, @yeahnah you are a life saver ! thanks a ton!

Re: Data Onboarding line break at empty lines

yeahnah — Thu, 18 May 2023 03:03:31 GMT

FYI - it's the \v metacharacter that makes it work. From the references I found it means vertical tab or vertical whitespace character, which in this instance would equate to the blank line.