I’m new to Splunk as well. This seemed like it would be straightforward, but…
I have a multiline extract from a data source. The fields are well defined but I can’t carve the fields and related data into columns within Splunk. Data example:
For each line in the multiline event (from “Row” to “Row”) I need a column and related data.
I have used BREAKONLYBEFORE=Row and SHOULD_LINEMERGE=true to break the events up but I haven’t found a way to establish the rest of the event fields.