https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241626#M71853 <P>Are you saying that in your file that you would like to merge lines such that they are treated as a multi-line event all the way until the last line which should contain "transactionid=" and then at the next newline, break the event there and start a new event?</P> Sat, 21 Nov 2015 19:37:01 GMT woodcock 2015-11-21T19:37:01Z https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241623#M71850 <P>Hi,</P> <P>Newbie in regex, would like help to add a line after transactionid=XXXXXX. My props looks like this:</P> <P>[source::/nyx/nogscore/log/nogscore-*]<BR /> SHOULD_LINEMERGE=False<BR /> BREAK_ONLY_BEFORE_DATE=false<BR /> LINE_BREAKER_LOOKBEHIND=500<BR /> LINE_BREAKER=(transactionid=[0-9]+)<BR /> DATETIME_CONFIG=CURRENT</P> <P>LOG:<BR /> NNNN :000.01| 06:37:15 [4067241XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2<BR /> NNNN :000.00| 06:37:15 [40672414XXX] ws_api12.cpp:279 * CHECK : 10 NOGS:::#name=wager;accountid=2-4410XXX-USD,USD;activationid=;apiversion=1.0;betamount=0.06;campaignid=;clienttype=html5;currency=USD;gpgameid=doctorlove;gpid=100;jpc=;loginname=XXX;opid=XXX;password=XXX;request=wager;roundid=529233;sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 (Like a new line after this)<BR /> NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2<BR /> NNNN :000.00| 06:37:15 [4059315XXX] ws_api12.cpp:606 * CHECK : 10 NOGS:::#name=result;accountid=2-44101XXX-USD,USD;apiversion=1.0;clienttype=html5;currency=USD;gamestatus=completed;gpgameid=doctorlove;gpid=100;houseincome=;jpwonamount=;loginname=XXX;opid=XXX;password=XXXX;request=result;roundid=529233;sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268349;wonamount=0.00</P> Tue, 29 Sep 2020 07:56:49 GMT https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241623#M71850 Giggs 2020-09-29T07:56:49Z https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241624#M71851 <P>Is your example one after you've manually inserted a carriage return into it, is it the actual LOG line as it sits on disk before Splunk ingested it, or the _raw event, or...</P> <P>Basically, do your events look like this (trimmed):</P> <PRE><CODE>sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2 </CODE></PRE> <P>or like this</P> <PRE><CODE>sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2 </CODE></PRE> <P>And do you want them to look like this</P> <PRE><CODE>sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2 </CODE></PRE> <P>or like this</P> <PRE><CODE>sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2 </CODE></PRE> Fri, 20 Nov 2015 13:54:14 GMT https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241624#M71851 Richfez 2015-11-20T13:54:14Z https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241625#M71852 <P>Looks like this :</P> <P>essionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 <BR /> NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2</P> <P>Want to look like this :sessionid=0000000CEDE13001c099559651a5ca63d5d325bde65907e3e55683dca0338159965a2fc1c2bfb311;transactionid=1268348 </P> <P>NNNN :000.01| 06:37:15 [4059315XXX] ws_proc.cpp:1002 - INFO : 00 NOGS::wallet version match: 1.2</P> Fri, 20 Nov 2015 14:06:08 GMT https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241625#M71852 Giggs 2015-11-20T14:06:08Z https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241626#M71853 <P>Are you saying that in your file that you would like to merge lines such that they are treated as a multi-line event all the way until the last line which should contain "transactionid=" and then at the next newline, break the event there and start a new event?</P> Sat, 21 Nov 2015 19:37:01 GMT https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241626#M71853 woodcock 2015-11-21T19:37:01Z https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241627#M71854 <P>I am going to assume you mean exactly what you said (which seems very strange to me). Do it like this in <CODE>props.conf</CODE>:</P> <PRE><CODE>[source::/nyx/nogscore/log/nogscore-*] SEDCMD-add_extra_newline_at_end_of_line_after_transactionid = s/(transactionid=.*$)/\1\n/g </CODE></PRE> <P>Note: After making changes to <CODE>props.conf</CODE> and deploying to Indexers (or Heavy Forwarders), restart all Splunk Enterprise instances to enable the configuration changes. This applies ONLY TO EVENTS THAT ARE INDEXED POST-RESTART.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles</A></P> Sat, 21 Nov 2015 21:04:48 GMT https://community.splunk.com/t5/Splunk-Search/regex-Adding-an-empty-line-after-value-found/m-p/241627#M71854 woodcock 2015-11-21T21:04:48Z